Is New Magento Security Patch required on fresh install?

Question

I installed Magento today with:

wget http://www.magentocommerce.com/downloads/assets/1.9.1.1/magento-1.9.1.1.tar.gz

I thought as this is the latest version I would not need to install the security patch casued the recent security breach.

The messages says:

Important: New Magento Security Patch - Install it Now It is important for you to download and install a new security patch (SUPEE-5994) from the Magento Community Edition download page (https://www.magentocommerce.com/products/downloads/magento/). Please apply this critical update immediately to help protect your site from exposure to multiple security vulnerabilities impacting all versions of the Magento Community Edition software. Please note that this patch should be installed in addition to the recent Shoplift patch (SUPEE-5344).

Do I really need to install this patch? Why would Magento not just include it in new downloads? Is there anyway I can verify the patch has been installed?

Answer 1

Yes, install it.

Look at the release dates of the files. 1.9.1.1 was released May 1, 2015. SUPEE-5994 was released on May 14, 2015. I can't actually recall when the Magento team backported patches like this. If you want the patch included, wait for (likely) the next release.

You can verify the patch was installed after you install it. It should say "Patched successfully" (or something along those lines.)