I got an email the other day saying my site was automatically updated to WordPress 4.3.2. How did that happen? I’m self-hosting this website, and I’d not logged in for a couple of months.
It turns out whenever your site requests a page, that is, someone visits your website, this page load will trigger a check for updates.
The update runs in the background via wp-cron. wpL_cron checks whether there are any scheduled events in the database. If yes it calls spawn_cron(), which starts another PHP process to do all the actual work.
Lots of processes in WordPress are handled by the cron system: scheduled post publishing, processing pings, update checks, etc.
The automatic update only happens when wordpress.org releases a new minor or security update. Otherwise (for a “major” release like WP 4.3 to 4.4) you must do the update manually by logging in to the back end.
I got this information from http://wordpress.stackexchange.com/questions/131334/how-exactly-do-automatic-updates-work. Thanks to “DisgruntledGoat” for asking and others for answering and explaning.