It's a big deal, especially for small dev shops, as they're less likely to have people available to plug security holes or monitor servers for vulnerabilities/compromises. If you're using shared hosting, probably not an issue. If you're using a VPS, PS, or other service where you are expected to maintain the server, well...
For some systems, it's just a matter of logging in to the server and running a single command line, like "sudo yum update bash" (replace "yum" with apt-get, or another package manager).
You can leave it, but know that you're leaving your clients vulnerable to things such as:
- stolen data
- data loss
- compromised/corrupted/deleted backups of data, code
- site disruption
- botnet participation
- illegal file dump/trading space
- unremovable rootkits
Having said that, I believe you should be safe if you don't use CGI to run your apps.
The earlier you plug the holes, the better.
