When a serious vulnerability is announced, attackers start scanning for unpatched systems within hours or days. The organisations that get hurt are rarely the ones without information; they are the ones without a routine that turns information into installed updates.
Know what you run
You cannot patch what you do not know exists. Keep an inventory of servers, operating system versions, control panels, databases, CMS platforms and plugins, and network devices. Note which are internet-facing; they come first.
Set a rhythm
- Critical, actively exploited vulnerabilities in internet-facing systems: patch within days, sooner if possible.
- Other security updates: on a regular schedule, for example weekly or monthly.
- Feature upgrades and major versions: planned projects with testing.
Automatic security updates are a good default for operating system packages on most servers. Applications and control panels need the same attention: an up-to-date server running an outdated CMS plugin is still exposed.
Reduce the fear of breaking things
The main reason patches are delayed is fear of downtime. Address the fear directly:
- Test on a staging copy when the change is significant.
- Take a snapshot or backup before patching.
- Patch during agreed maintenance windows and announce them.
- Use redundancy where it matters, so one server can be patched while another serves traffic.
Track and report
Record what was patched and when. A monthly report of open vulnerabilities by age makes the backlog visible to management and is exactly what auditors ask for.
End-of-life is a patching problem too
Software that no longer receives updates cannot be patched. Track end-of-life dates for operating systems, PHP versions and databases, and plan replacements a year ahead.
How IDX helps
IDX managed servers include patching as part of the service, with maintenance windows agreed with you. On shared and web hosting, we keep the server platform updated, and the control panel lets you update your own applications. Our status page announces planned maintenance in advance.
IDX on digital infrastructure
Back to blog →