What gets maintained
Security patches
Within 24 hours
Matched to affected packages, prepared and applied. Most fixes need no reboot.
Regular software versions
Managed rollouts
Supported runtimes, databases and tools receive updates with compatibility checks.
Distribution releases
Reviewed upgrades
Prepare the next system from its recorded definition. Major upgrades include compatibility checks.
Routine kernel reboots
Your window · 7 days notice
The prepared kernel becomes active after reboot. The server briefly interrupts service.
Actively exploited issues
Urgent · 4 hours notice
When a reboot is required, it happens within 24 hours, overriding the routine window. An available fix and verification are still required.
A patch is only done when it’s running.
Most changes apply live. A new kernel needs a reboot to take effect.
Around your schedule.
Planned maintenanceRoutine reboots get advance notice and an eligible maintenance window.
The update is available. The running kernel has not changed.
The patched kernel remains staged but inactive until the reboot.
The reboot activates the prepared kernel and briefly interrupts this server.
The server is back and the running kernel is checked. Prepared is now active.
Priority changes. Care stays.
Urgent responseAffected, actively exploited issues are escalated. Critical reboot schedules can override the usual window.
An affected, actively exploited issue is escalated for urgent attention.
An available fix is checked and prepared. Urgency does not remove verification.
A critical reboot can override the routine window. Activation still has to happen.
The running state is verified after activation. An alert alone is not a completed fix.
Example local-time window. Routine schedules include advance notice. Urgent response is not a guarantee of an instantaneous fix.
WordPress security fixes are opt-in. See the protected site-update sequence.