&gt; I trust I can count on Debian&#x2F;Ubuntu&#x2F;RHEL will ship a new package for every critical CVE promptly, without forcing me to upgrade to the latest upstream version.<p>There was an article just a couple of weeks ago pointing out that distributions frequently don&#x27;t fix security issues:<p><a href="https:&#x2F;&#x2F;statuscode.ch&#x2F;2016&#x2F;02&#x2F;distribution-packages-considered-insecure&#x2F;" rel="nofollow">https:&#x2F;&#x2F;statuscode.ch&#x2F;2016&#x2F;02&#x2F;distribution-packages-consider...</a><p>No doubt it&#x27;s better for high-profile applications, but there are far more applications that people want to use than distros have the resources to issue security updates for.