Drush - set Drush backup directory manually
Typically, Drush will place backups in the home directory. Occasionally, the home directory is the webroot - in the event of this, you will need to set a directory (outside of webroot) that can be backed up into.
drush up --security-only --backup-dir=/[directory]