Linux doesn't self-update. The major vendors support unattended updates, but kernel patches mean reboots. An unpatched kernel is a vulnerable one. This article on KernelCare.com looks at the dilemma Linux system administrators face in trying to keep servers safe without rebooting them, and what they can do to resolve it.