Keep Your Server up to Date with Automated Security Updates
Updated November 3, 2026 · 7 min read
xCloud keeps the operating system of every server it provisions up to date: the server installs Ubuntu security updates on its own, every day, without any action from you. From the server’s ‘Security Update’ page you control two more things: whether the server reboots by itself when an update needs a reboot, and whether it also installs updates for the services xCloud installed, such as PHP, the database, Redis and Node.js. The same page lists every service on the server and whether it is up to date. For an overview of what it does and which plans include it, see the automated security updates feature page.
These are separate settings, and the second one matters for PHP and Node.js security releases. xCloud installs these services from their own repositories, not from Ubuntu, so Ubuntu’s security updates never pick up their patch releases. ‘Managed Service Updates’ is off by default. Turn it on if you want those patches installed automatically too.
What the Server Updates on Its Own
Every xCloud server installs Ubuntu’s security updates by itself, once a day. These cover the kernel, OpenSSL, system libraries and the other operating system packages. This is always on and has no setting.
| Service | Updated automatically by default? | How to keep it patched |
|---|---|---|
| Ubuntu packages (kernel, OpenSSL, system libraries) | Yes | Nothing to do. Reboot when asked, or turn on Automatic Reboot |
| PHP (NGINX servers) and LiteSpeed PHP (OpenLiteSpeed servers) | No | Turn on Managed Service Updates, or patch from Manage PHP |
| MySQL 8.4, MariaDB 11.8 | No | Turn on Managed Service Updates |
| MySQL 8.0 on Ubuntu 22.04 or later | Yes, through Ubuntu security updates | Nothing to do |
| MariaDB 10.x | Before the AL-2026-144 patch: yes, through Ubuntu security updates. After it: no | Managed Service Updates does not cover MariaDB 10.x. Once the AL-2026-144 patch is applied, the server gets MariaDB from the MariaDB repository, so Ubuntu’s updates no longer reach it and its row reads ‘Not included · Not updated automatically’. Check its badge under ‘Components on this server’. If it stays on ‘Update pending’, contact support |
| Redis from the Redis repository | No | Turn on Managed Service Updates |
| Node.js from the NodeSource repository | No | Turn on Managed Service Updates, then check its row, or update Node.js yourself |
| NGINX from Ubuntu | Yes, through Ubuntu security updates | Nothing to do |
| NGINX from nginx.org, OpenLiteSpeed | No | No automatic updates. Contact support if you need a patch |
| Docker | No | Not included, because a Docker upgrade restarts every container |
For the details of how Ubuntu’s update streams work and how to check a single package, read How Automated Security Updates and Auto Reboot Work in xCloud.
When a Reboot Is Required
Some updates, most often kernel updates, only take effect after a reboot. When one is installed, xCloud tells you in two places:
- Email notification: you receive an email that the server needs a reboot.
- Server notice: a notice saying the server requires a reboot appears on the server’s pages, with a ‘Reboot Now’ button. The ‘Security Update’ page also shows a ‘Reboot pending’ chip.
Click ‘Reboot Now’, check the list of updates, then click ‘Reboot’. xCloud installs any pending security updates first, then restarts the server if a restart is still needed. Your sites are briefly unavailable during the reboot, so test them afterwards.
With ‘Automatic Reboot’ on, this notice stays hidden on the server’s other pages, because the server reboots by itself at your ‘Reboot Time’. A server created in the last 12 hours doesn’t show it either.
If you’re not ready to reboot, you can ‘Skip’ the notification for 3, 7 or 30 days, or ‘Always Skip’ it for that server. The ‘Security Update’ page then shows that reboot notifications are snoozed or disabled, with a ‘Re-enable Notifications’ button to turn them back on.
How to Set Up Automated Updates in xCloud
All the settings live on one page per server. You change them in the ‘Security Update’ card, and the ‘Components on this server’ list below it shows the result.
Step 1: Open the Security Update Page
Open your server and go to ‘Security’ → ‘Security Update’. You can also click ‘Configure Auto Reboot’ in the reboot notice.
Don’t see the switches? Ask a team member with the Security Update permission.
The chips at the top show what runs on this server at a glance:
- Ubuntu security updates: always on.
- Automatic Reboot: off, or on with its time.
- Reboot pending: appears only when an installed update is waiting for a reboot.
- Managed Service Updates: off, or on with its time.
- Components: how many services are up to date and how many have an update pending.
Step 2: Turn On Automatic Reboot
Turn on ‘Automatic Reboot’ and set a ‘Reboot Time’. The time uses the server’s timezone, which is shown next to the field label. The card then confirms when the server will reboot.
The server reboots at that time only if an installed update needs a reboot. If nothing needs one, nothing happens that day. Pick a low-traffic time.
Step 3: Turn On Managed Service Updates
Turn on ‘Managed Service Updates’ and set an ‘Update Time’ (default 03:00, in the server’s timezone). The card shows how long until the next run. Leave it off, and only Ubuntu security updates install.
Once a day at that time, the server installs updates for the services this setting covers. The server’s daily Ubuntu security run moves to the same time. Each service stays on the series it already runs: PHP 8.3 stays on 8.3, Redis stays on its major version and Node.js 22 stays on 22.
PHP, the database, Redis and Node.js restart when they update, so choose a quiet time for your sites. Node.js sites are handled gently: after a Node.js update, xCloud reloads only the running PM2 apps that still use the old Node.js version. Apps you stopped stay stopped, and Docker apps are not touched, because they bring their own Node.js. Apps that run from a release folder keep serving on the old Node.js until their next deploy or settings update, which loads the new version.
Step 4: Save Settings
Click ‘Save Settings’. You see ‘Security update initiated successfully’ while xCloud applies the settings on the server. The server must be connected. The new settings are kept only if the server accepts them, so reload the page after a minute to confirm they stuck. Saving with ‘Managed Service Updates’ on installs nothing right away. Patches install at the next ‘Update Time’. If Automatic Reboot is on and Managed Service Updates is off, saving installs pending Ubuntu security updates right away.
On a server with Node.js, you may see ‘Save to verify the Node.js Coverage’ next to the button. Saving is what checks Node.js on the server, so click ‘Save Settings’ even if you changed nothing else. The result appears in the Node.js row within about a minute.
Step 5: Check the Components List
Scroll to ‘Components on this server’. It lists the services installed on this server, whether ‘Managed Service Updates’ is on or off, so a server without Redis has no Redis row. Click ‘Check now’ to check the server again. The time next to the button shows the last check.
The line under each service name tells you how it gets updated:
| What the row says | What it means |
|---|---|
| Managed | Patch releases install daily at your ‘Update Time’ |
| Managed when on | Turn on ‘Managed Service Updates’ to include this service |
| Ubuntu security updates | Ubuntu installs its security patches every day. Nothing to do. MariaDB 10.x shows this line until the AL-2026-144 patch is applied |
| Not included | Automatic updates skip this service. The row gives the reason |
| Not updated automatically | Neither setting updates this web server |
The badge on the right tells you where the service stands right now:
| Badge | What it means |
|---|---|
| Up to date | The last check found no update for this service |
| Update pending | An update is available. The row says whether it installs by itself |
| Manual | NGINX from nginx.org, and OpenLiteSpeed before its first check. The check can’t report on NGINX from nginx.org, so its badge never changes |
| Not checked yet | No check has run. Click ‘Check now’ |
Why a Service Is Not Included
Every ‘Not included’ row states its reason. These are the ones you can see:
| Row | Reason shown | What to do |
|---|---|---|
| Docker | a Docker upgrade restarts every container | Nothing. Automatic updates skip Docker on purpose |
| MariaDB 10.x | Not updated automatically | Shown once the AL-2026-144 patch is applied. Managed Service Updates covers only MariaDB 11.8. Check its badge under ‘Components on this server’, and if it stays on ‘Update pending’, contact support |
| Node.js 14 | Node.js 14 uses a tarball and has reached end of life | Move to Node.js 22 or 24 |
| Node.js | Save Managed Service Updates to verify the NodeSource repository | Click ‘Save Settings’ with the setting on |
| Node.js | no NodeSource repository is configured | Choose a different version under ‘Default Node.js Version’ in ‘Management’ → ‘Node Configuration’, then click ‘Save Settings’ on this page. This changes the Node.js version your apps run on, so redeploy them and check they still work. If the row does not change, contact support |
| Node.js | the NodeSource repository major does not match the installed major | Choose a different version under ‘Default Node.js Version’ in ‘Management’ → ‘Node Configuration’, then click ‘Save Settings’ on this page. This changes the Node.js version your apps run on, so redeploy them and check they still work. If the row does not change, contact support |
| Node.js | The installed Node.js version is not available | Choose a version under ‘Default Node.js Version’ in ‘Management’ → ‘Node Configuration’, then click ‘Save Settings’ on this page. This changes the Node.js version your apps run on, so redeploy them and check they still work. If the row does not change, contact support |
Check the Node.js row on servers where this setting was already on. Node.js is covered only when its row says ‘Managed’. If it says ‘Not included’, follow the reason shown.
On OpenLiteSpeed servers, PHP shows as lsphp (LiteSpeed PHP). The OpenLiteSpeed row says ‘Not updated automatically’, and so does the nginx (nginx.org) row on servers that run NGINX from nginx.org.
If the server has no services from this list, the ‘Managed Service Updates’ card doesn’t appear and the list says ‘No managed services on this server’. Ubuntu security updates still patch the system packages.
Note: Need a PHP security patch right away, before the next daily run? Install it from ‘Management’ → ‘Manage PHP’ with ‘Scan Patch’ and ‘Update to’. See Install PHP Security Patches. For Node.js, see How to Update Node.js.
Final Outcome
After the server reboots, the reboot notice and the ‘Reboot pending’ chip disappear. With both settings on, the server installs Ubuntu security updates and updates for its managed services every day, and reboots on its own when an update needs it.
Frequently asked questions
Are PHP security patches installed automatically?
Only when Managed Service Updates is turned on. Ubuntu’s security updates do not include PHP patch releases, because xCloud installs PHP from its own repositories. With the setting off, install PHP patches from Management → Manage PHP with Scan Patch and Update to.
Does Automatic Reboot install updates?
No. The server installs security updates by itself. Automatic Reboot only decides whether the server restarts on its own, at your reboot time, when an installed update needs a reboot. One exception: saving the page with Automatic Reboot on and Managed Service Updates off installs pending Ubuntu security updates right away.
Will Managed Service Updates upgrade me to a new major version?
No. Each service stays on the series the server already runs, for example PHP 8.3 stays on 8.3 and Node.js 22 stays on 22. Updates stay within that series.
Why does Node.js say Not included?
Node.js patches install only when your server’s Node.js version, such as 22, matches the version of the package source xCloud set up for it. The Node.js row tells you if it doesn’t, and gives the reason. Node.js 14 is never included. If the row says to save, click Save Settings with Managed Service Updates on, and xCloud checks the server.
Does this work on OpenLiteSpeed servers?
Yes. On OpenLiteSpeed servers the setting covers LiteSpeed PHP. OpenLiteSpeed itself is not updated automatically.
Still stuck? Contact our dedicated support team for any of your queries.