What's the best way to automatically apply security updates? Or any updates for that matter?
Note that some updates (on a server, it tends to be most updates, from personal experience) require restarting one or more services, or even rebooting the entire server, to take effect. Restarting services, much less rebooting, isn't really a task I feel comfortable automating.
I use cron-apt on my server to automate downloading, but not installing, updates. It does it once a day rather than running as a daemon. It emails me when there are updates waiting to install.
When I receive such an email, I log in when it is convenient and install the updates, then restart whatever services need restarting.
It's not usually obvious which services need to be restarted. For example, an update to libssl usually requires restarting just about every web, mail, SSH etc service there is. Or an update to libpng might require restarting Apache because PHP links to it.
So I use
I also know that if the kernel is updated, I always need to reboot.