I have two questions:

  1. When you apply the latest security patch, does it patch up previous vulnerabilities? For example, if I patch my site with SUPEE-5994 do I still have to patch it with SUPEE-5344 and SUPEE-1533 if I haven't done so already? If I would have to apply the previous patches, is there a sequence I should do it in? IE. SUPEE-1533 then 5344 then 5994?

  2. Install patch through PHP I am going to use this method of patching since I believe it is the easiest method for me since I am not familiar with the SSH method. However in one of the comments, Kevin Schroder says:

    This method requires the webserver to have write access to the files. If you use this method make ABSOLUTELY sure that you change perms back to what they were so the web server cannot write to the files besides /media and /var –

Does this mean I have to CHMOD a certain file(s) or folder(s) to a certain permission? Can someone clarify this so that a little kid can understand. :)


1 Answer 1


Each Magento patches are different and you need to apply all those patches. A magento patch is a fixation for a particular issue. A particular issue is fixing by changing logic flow of a certain portion of Magento core code basis. (Most of the cases, this will be changing 4, 5 lines of codes. But it may be large too). So different patches means different security vulnerabilities. So the code fixing is carrying out in different part of Magento core code base. Due to this, in order to avoid all security vulnerabilities, you should apply all Magento patches.

You can carry out installation via ssh, if you have root privilege. Using your root privilege you need to give 777 permission to .sh file. After applying those security patches, then you need to remove the write permission from those files. I am not sure about this point, because I am a developer and I am not good in permission stuff. You can refer this for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.