The “message of the day” (“motd”), which is what indicates whether there are packages that need updating, or the system needs to be rebooted, or whatever, is dynamically generated on Ubuntu systems at login, via the update-motd(5) system, which is in turn invoked by pam_motd.so during login (unless otherwise modified by the system admin). The specific program which detects if updates are required and writes the appropriate verbiage is /usr/lib/update-notifier/update-motd-updates-available, which is a vaguely readable shell script that, once you chew through the boilerplate, calls /usr/lib/update-notifier/apt-check --human-readable, which you yourself can call at any time (even as a non-root user) to tell you what’s what. The information may be a little out of date, because the apt package lists only get refreshed once a day (via /etc/cron.daily/update-notifier-common, which calls /usr/lib/update-notifier/package-data-downloader), but within 24 hours of a security update becoming available you should see it reported in that apt-check call (you can also run sudo apt-get update yourself, which will update the package lists immediately).
And yes, this isn’t a Linux forum. 