What is the best way to update Drupal periodically using a cron job? Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" according to https://www.drupal.org/node/1173280 

Lately I noticed that when security issues are really urgent, the update can take place just any time during the week. I now let the update cron take place every hour every day. I am aware this is not an ideal solution. What is the better solution to update Drupal with a cron script say within the hour of any release?
How can we automate our updates when these exceptions take place?


Updates are not automatic. The update manager module will tell you (in the admin) when critical updates or updates are available for core or contributed modules. But nothing will automatically update it all for you. You can also have the system email you when updates are found, too - per site. This is also helpful for staying informed.

You could theoretically "auto update" with a CI/build workflow that builds X times per day, but there is more inherent risk there of breaking the site unless you are strict about versions of contrib, and specify drupal/core as ~8.0 and minimum stability stable. Though, that is not bulletproof. In the last update from 8.4 to 8.5, I had to patch over a contrib module due to a change introduced in core. That contrib module still has not updated to comply with the change. If I had this sort of workflow, core would have updated and broke the site. That isn't so much the fault of core, but the contrib module(s) not keeping pace with the changelog or the sometimes unfortunate BC breaks.

While auto update sounds like a good idea, its usually not worth the mentioned risk. I prefer to clone locally and run through the application to see if anything has changed, moved, or flat out broke instead of have it hit production immediately. I think most would agree.

With this latest PSA, everyone was given a weeks notice that it was coming so people could prepare and plan their release window around it. So there should have been plenty of time to stay informed, and most hosting companies (i.e.: ones who promote Drupal) should have notified their customers.

Wednesday is when the Security Team makes public any security issue on covered third-party modules.