What about using distro packages? That would insulate you from upstream suddenly turning malicious. I'm not sure if Debian's packages are kept up to date with

What about using distro packages? That would insulate you from upstream suddenly turning malicious. I'm not sure if Debian's packages are kept up to date with security patches, though. The latest changes to the wordpress package[0] were in December 2022 and and May 2024. [0] https://metadata.ftp-master.debian.org/changelogs//main/w/wordpress/wordpress_6.1.6+dfsg1-0+deb12u1_changelog https://metadata.ftp-master.debian.org/changelogs//main/w/wo...