Security updates for the freepbx distro?

How are these usually handled? Is it just via ‘yum update’ ?

Any component managed via RPM would be updated through yum.

FreePBX module updates are managed through FreePBX

Well the proper way is to use our combined upgrade scripts which take care of EVERYTHING in the PBX as far as updating from the OS, Asterisk, FreePBX and everything else.

Shameless plug for System Admin Pro since I found out that not only do they apply all these updates, you can just click on the last update in System Admin Pro and it does ALL the cumulative updates to that point - $25.00 Well Spent!