Patch before it's exploited: security updates and breach warnings in FrontierStack 2.15

Published 2026-11-03

Most break-ins don't need a new trick. They use a flaw that was fixed weeks ago, on a server that never installed the fix. FrontierStack 2.15 adds a Security Updates pane. For every server you manage, it shows which security fixes are waiting, which of them close holes attackers are already using, and which systems no longer get fixes at all. If you want, it installs security updates for you, only inside a window you choose.

It joins the breach warnings FrontierStack already has. Between them they cover the two ways trouble usually arrives from outside your own code: a company you depend on is breached, or software you run has a published flaw.

What each server is waiting for

FrontierStack asks each server's own package manager, because only the server knows what is really installed:

• Debian and Ubuntu: updates from the -security pocket.
• RHEL, AlmaLinux, Rocky, Fedora and Amazon Linux: dnf or yum security advisories, with their CVE numbers.
• openSUSE and SLES: zypper security patches.
• FreeBSD: pkg audit.
• Alpine: updates checked against OSV.dev, because apk doesn't mark security fixes.
• macOS: Software Update, plus Homebrew formulae that are out of date. Homebrew doesn't say which updates fix security problems, so those are listed separately.

The check only reads. It runs every six hours, as root where you've saved a sudo password. The one thing it changes is apt's package lists, which it refreshes when they are more than a day old, just as apt's own daily job would.

Which ones can't wait

A server with forty waiting updates usually has one or two that matter today. FrontierStack ranks them with public sources:

• CISA's Known Exploited Vulnerabilities list. If a waiting update fixes a CVE that attackers are known to be using, the server turns red and you are alerted at once, through the same channels as every other FrontierStack alert.
• OSV.dev supplies the CVE numbers behind Debian, Ubuntu and Alpine updates. FrontierStack sends it only the package name and version, never a hostname or address.
• endoflife.date says which operating systems and runtimes no longer get fixes: Ubuntu 20.04, an old PHP or Node.js branch, a macOS release Apple has stopped patching. PHP or Python that came with a Linux distribution isn't flagged, because the distribution backports fixes to it.
• Enfour patch advisories. When something urgent needs explaining, like PHP's critical fixes in October, we publish an advisory with the fixed version for each branch and the steps to take. It is signed the same way as our breach advisories, with a key of its own.

Routine security updates raise an alert only once they have waited longer than you choose, seven days by default. Exploited vulnerabilities, advisories and unsupported releases alert straight away.

Automatic security updates, only where you say

Patching by hand stops working after a handful of servers. In 2.15 you can turn on automatic security updates for each server separately and give it a maintenance window, Sunday 3:00 to 5:00 for example. Inside the window FrontierStack installs security updates and nothing else:

• apt installs only the packages from the security pocket, and keeps your configuration files.
• dnf and yum run their --security upgrade; zypper installs security patches.
• FreeBSD upgrades the packages pkg audit reported; Alpine upgrades the packages OSV lists as vulnerable.
• On a Mac it upgrades only the Homebrew formulae an Enfour advisory names, as your user, never as root.

Before each run it checks that there is enough free space. Afterwards it compares which services are running and tells you if one has stopped. It never restarts a server: when a kernel update needs a reboot, it says so and you pick the moment. It never installs macOS updates, and it never touches OPNsense or pfSense, which have their own firmware updater. Each window runs once, however often FrontierStack looks inside it.

You can also let fixes for exploited vulnerabilities go in as soon as they appear, without waiting for the window. On a Mac you can require a recent Time Machine backup first.

Because this runs as root on your servers, turning it on is deliberately hard for anything but you. Saving an automatic-update schedule, or pressing Install Security Updates Now, needs a real person at the Mac (Human-Presence Approvals, with Touch ID if you have chosen it). Every run goes into the audit log. The AI Administrator can read all of this and tell you what to fix first, but it cannot install anything.

And when a vendor is breached

The other half was already there. When a service people paste API keys into is breached, Enfour publishes a signed advisory, usually within hours. Recent ones covered STUDIO, Railway, OpenCode, the tampered LiteLLM release, and a flaw in self-managed GitLab. FrontierStack and KeyRotate check for new advisories twice a day and verify Enfour's signature before trusting one.

• FrontierStack recognises sites built with an affected service from their pages, shows the vendor's checklist in that service's pane and keeps an alert open until you mark it dealt with.
• New in 2.15: the alert also fires when the affected software is installed on this Mac or reported by one of your servers, not only when a website is built with it.
• KeyRotate knows which keys you saved in the service and helps you replace them. Its Leak news page shows the same advisories on the web.

What it doesn't do

FrontierStack can't see backups on Linux servers, so it can't wait for one there: take your own snapshot before a window. Distribution packages often carry a fix under an old version number, so for those it trusts the distribution's own security data rather than version numbers. And it won't restart anything for you. Those decisions stay yours.

Getting started

Update to FrontierStack 2.15 and open Security Updates under Security Tools. The first check starts a minute after launch, on this Mac and every linked server. Start with the red rows. When you're happy with what a server would install, open Automatic Updates… and give it a window. Automatic updates on linked servers are part of Full Fleet.