Microsoft tries to update your nodes every night on its own, you may not have rebooted nodes for a long time in order to apply fixes. The easiest way to do this is through KureD. When Kured finds a reboot-required file, it will change its status to "Ready" and then the nodes will be upgraded. You can read more about
KureD here. It also says how to launch it, because runs with Linux.