I think Debian is probably pretty conservative in their updates. I also recommend checking out the needrestart package. It will tell you when a reboot is needed because of a newer kernel that was installed, or when a systemd service needs a restart.

But as another commenter noted, outside of self hosting, in enterprise businesses environments where you manage an army of servers, things look different. But then, these guys are paid to be on-call in the weekend for events like these. :)

Unattended application to test. If it passes testing, unattended application to prod.

I still wouldn't do this for any critical service, but for a "move fast and break things" system like Facebook where it goes down and nothing bad happens, sure.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don't notice (i.e. don't need the service) than having open vulnerabilities when a fix exists.

Yeah, for businesses I can see that, but selfhosting, meh. I have just one personal server firewalled and Wireguarded, so the PHP vulnerability wasn't even publicly exposed. Even so, I have never had any issues with Debian's unattended security upgrades in the last 5 years.

In enterprise environments with a hundred servers, though, you will want to do something else than I do. :)

But even then, don't enterprises run a good WAF in front of their public web sites that would have received the patch automatically?

Well, we're talking (Debian's) security updates only here, not major PHP version jumps. :)