Unattended automatic security updates / upgrades [duplicate]

Question

What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method?

For motivation, consider this: Drupal just released a PSA about a recent vulnerability saying:

...You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is 7 hours after the announcement.

Fortunately I caught this one and performed the update manually one hour after the announcement. But what if I hadn't? I'd like to have an automatic update process in place to give me some piece of mind.

And I'd like for this automatic upgrade system to only apply security updates. (It just doesn't seem worth the risk to bother with potentially breaking some functionality after an update, unless the update is critical.)

Answer 1

Please also keep in mind there are '0-day' vulnerabilities out there, which can be used to compromise your website even before Drupal publishes a security advisory and corresponding patch. And that even if you use an automated update for Drupal core, there still will be a time window in which your site was vulnerable.

The best way to deal with these kind of issues is therefore to have all your Drupal code in a version control system - Subversion or Git for example. This way you can easily:
- identify when there has been an intrusion with a status command (this will show you all modified files in your source files)
- reverting these changes, and therefore repair all harm done, by resetting the source tree to your latest commit

The only downside is that you have a little more work to do with each update, as you need to commit all changes back to your repository after each code change. But this is a very small price to pay for the added benefits and piece of mind this provides.

Answer 2

There's a huge discussion regarding this. Follow up https://www.drupal.org/node/2367319 and decide.