I recently started using Ubuntu server LTS for some production web servers due to the fact that it is SO easy to run.  However, usually I guess you get what you pay for.  I’ve noticed that many major packages for things such as Apache2 and PHP5 don’t really stay up to date too much. For instance the newest package available using aptitude is 2.0.55, yet the newest available on apache.org is 2.0.63.

Now, I understand the package maintainers mostly keep these up to date out of the kindness of their heart and in their spare time, and really we’d all be nowhere without them.  However, do many have an issue running these systems that are so out of date due to security concerns?

Are many admins out there really running Ubuntu LTS in production environments that face the internet?

Just wondering if anyone has any thoughts on this issue as two of my boxes were recently compromised and frankly I don’t know if it was my system or the application running on it, or a combination of the two and I’m not sure what I should plan on doing in the future

Thanks!