As I didn't easily find a simple and short upgrade instruction to install a simple security upgrade, I'm documenting here what I do to run my current security upgrade from what I guess should be the easy and correct way...

It's what I just did to get from drupal 6.8 to 6.9 - so it's about a minor / security upgrade.

I'm assuming all the steps are made on a testing setup first, and the effect is checked there, first, before it's deployed to the live system!

• rename the old cms dir on my webserver - mv cms cms-6.8
• unpack the new package into the cms dir - tar xvfz drupal-6.9.tar.gz
• give the extracted directory the right name - mv drupal-6.9 cms
• take over the site-specific data from the old to the new system - rsync -av --delete cms-6.8/sites/ cms/sites/
• test if things work well...

Now you can go to your live site, set it to offline mode so users won't be distracted when things don't work while the update is running, and sync your test system with the live system - and set it online again. (depending on your host, when the switch is a matter of two mv commands, offline setting might not be needed).