I’d definitely back up before any major OS update. It's hard to predict what each update will do or whether it might break dependencies. I'd avoid updating PHP. We addressed the vulnerability as soon as it was announced with a coordinated FS PBX update. Some people updated manually too soon, which caused some services to stop working. Nothing serious happened; they just needed a restart. The FS PBX update handles that automatically, so there are no issues.