Update all the things: why patching matters for WordPress, Odoo and servers
Unpatched software is now the most common way attackers get into the organisations they breach, and they move within days of a flaw becoming public. An update closes the door before they arrive. This article explains how updates work for the software most businesses run online, the control panel, WordPress, Odoo and the Linux server underneath, and who is responsible for each one.
How fast flaws are exploited
Three reports from 2026 tell the same story:
- Verizon's 2026 Data Breach Investigations Report found that exploited software flaws were the way in for 31 per cent of breaches, ahead of stolen passwords for the first time in the report's 19 years.
- Google's Mandiant M-Trends 2026 found exploits the most common way in for the sixth year running, and estimated that exploitation now often begins before a patch is even released. In 2018 and 2019 the average gap between a flaw being disclosed and being exploited was 63 days. By 2023 it was five.
- The same Verizon report found only 26 per cent of flaws known to be exploited were fully fixed during 2025, with a median of 43 days to fix them.
The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a public catalogue of vulnerabilities known to be exploited, with more than 1,700 entries, and tells every organisation to use it to decide what to patch first. Since June 2026, US federal agencies get as little as three days to fix the most dangerous entries. The UK's Cyber Essentials baseline asks for critical and high-risk fixes within 14 days and automatic updates wherever possible.
The lesson for any business is that "we'll update next month" is now too slow.
The control panel: Plesk
The control panel manages websites, mail and databases on a hosting server, so a flaw in it can reach everything on that server. Plesk installs its own updates automatically by default and checks for new ones every day, and its documentation recommends keeping it that way. In 2026 Plesk published several fixes for flaws that could let a hosting user gain full control of a server; the fix in each case was the update.
On Noiz shared hosting, patching the server and the Plesk panel is Noiz's job.
WordPress: core, plugins and themes
WordPress has three layers, and they update differently.
| Layer | How it updates |
|---|---|
| WordPress core | Minor and security releases install automatically by default (since WordPress 3.7). New installs since 5.6 also take major releases automatically. |
| Plugins | Automatic updates are available since WordPress 5.5 but are off until you turn them on, plugin by plugin. |
| Themes | The same as plugins: available, but off by default. |
Core is well looked after. In July 2026, when two serious core flaws were fixed in WordPress 7.0.2, WordPress.org pushed the update out through the automatic update system, and CISA later listed both flaws as exploited. Plugins are where most risk lives. Patchstack, a WordPress security company, reports in its own research that 91 per cent of the WordPress vulnerabilities it recorded in 2025 were in plugins and 9 per cent in themes.
WordPress's own advice is simple: only the latest version is officially supported, keep plugins and themes updated, and delete the ones you do not use. Have a backup and a way to roll back before you update, because an update can occasionally break a site.
Odoo
Odoo releases a new major version each year and gives each one three years of standard support. Odoo's documentation states that security updates are provided only during standard support. Odoo 17, for example, left standard support in September 2026.
Two kinds of update matter:
- Updates within a version fix bugs and security flaws. They should be applied promptly, with a backup of the database and files first.
- Moving to a new major version is a migration: the database is upgraded, custom modules are ported and the result is tested on a copy first. Odoo recommends staying on a supported version.
Odoo shares advisories and fixes privately with Enterprise customers two to three weeks before it publishes them, so anyone running Community should apply updates as soon as they appear.
The server underneath
Every application sits on an operating system, and the operating system needs its own updates.
- Ubuntu LTS releases get five years of standard security maintenance. Ubuntu 22.04 reaches the end of standard maintenance in May 2027, and 24.04 in May 2029.
- Debian supports each stable release for three years, then volunteers and companies provide long-term support. Debian 12 is covered until 30 June 2028.
- Automatic security updates with unattended-upgrades are on by default in Ubuntu and usually in Debian. Run
sudo dpkg-reconfigure unattended-upgradeson Debian to check.
When a release reaches the end of its support, the fix is to upgrade it, not to keep patching. Our help article How to upgrade Ubuntu Server to a new release over SSH safely goes through it.
Applications such as Nextcloud and Mailcow
Self-hosted applications have their own cycles. Nextcloud releases a major version every four months and supports each for a year. Mailcow publishes updates at least once a month. Both have their own update tools, and both expect a backup first.
Who updates what
| You run | Who patches it |
|---|---|
| Noiz shared hosting | Noiz patches the server and Plesk. You update your own sites, themes and plugins, unless you add WordPress Care. |
| WordPress with WordPress Care | Noiz runs weekly core, plugin and theme updates with a restore point first, and patches known plugin and theme vulnerabilities as fixes are released. |
| Managed Odoo | Noiz runs the server and applies Odoo updates within the installed version, with a backup before every change. Major version upgrades are quoted as a migration project. |
| Managed Nextcloud or Private Email | Noiz runs the updates and backups, and keeps the service watched. |
| A Noiz Cloud server | You patch the operating system and everything on it, unless you ask Noiz for Linux administration. |
A routine that works
- Turn on automatic updates wherever they are safe: security updates on the server, minor WordPress releases.
- Back up before every manual update, and know how to restore.
- Remove what you do not use. An unused plugin or application still needs patching.
- Check end-of-support dates for your operating system and major applications once a year.
- Watch for urgent fixes. When a flaw is in CISA's catalogue, treat it as days, not weeks.
If you would rather not be the one watching for fixes, WordPress Care and Managed Odoo put the updates on Noiz's side.
Sources
- Verizon, 2026 Data Breach Investigations Report, executive summary: https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
- Google Cloud, M-Trends 2026: https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
- Google Cloud, 2023 time-to-exploit trends (15 October 2024): https://cloud.google.com/blog/topics/threat-intelligence/time-to-exploit-trends-2023
- CISA, Known Exploited Vulnerabilities catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA, BOD 26-04, prioritising security updates based on risk (10 June 2026): https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- NCSC, Cyber Essentials requirements v3.3 (April 2026): https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf
- Plesk Obsidian, Plesk updates: https://docs.plesk.com/en-US/obsidian/administrator-guide/plesk-updates.59215/
- WordPress, upgrading WordPress: https://developer.wordpress.org/advanced-administration/upgrade/upgrading/
- WordPress, plugin and theme auto-updates: https://wordpress.org/documentation/article/plugins-themes-auto-updates/
- WordPress, security: https://wordpress.org/about/security/
- WordPress 7.0.2 security release (17 July 2026): https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- Patchstack, State of WordPress Security in 2026 (vendor research): https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
- Odoo, standard and extended support: https://www.odoo.com/documentation/19.0/administration/standard_extended_support.html
- Odoo, upgrade: https://www.odoo.com/documentation/19.0/administration/upgrade.html
- Odoo, security reports: https://www.odoo.com/security-report
- Ubuntu, release cycle: https://ubuntu.com/about/release-cycle
- Debian, releases: https://www.debian.org/releases/
- Debian wiki, LTS: https://wiki.debian.org/LTS
- Nextcloud, maintenance and release schedule: https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule
- Mailcow, updates: https://docs.mailcow.email/maintenance/update/
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
