WordPress sites got auto upgraded [duplicate]

In order for the update to occur, the site would have had to receive some form of traffic. Any traffic which loaded WordPress would do. Alternatively, anything which started the wp-cron.php process would trigger the update as well, like if you have it set to run that with a normal cron.