We all know that keeping a web server updated is very important to avoid bugs and been hacked. I had experiences where an update broke an application:
For example: you have a site running with PHP 5.2 but and automatic update updates to PHP 5.3 and your application is broken. I think the best procedure is to test the updates on a staging server, then if the application is not broken we can apply the updates to the production server.
I think that automated updates are dangerous. What do you thing and do you know any good document on this topic or good practice that is widely adopted?