### Applying patches with no SSH access

You have a good point here. The patches are supplied as `.sh` files and there is no solution offered by Magento for FTP only websites.

I suggest one would copy his website's code to a local environment through FTP. Then apply the patch by running the `.sh` file.

If you would open the `.sh` patch file, then you will see it consist of two sections:

1. Bash shell code to apply the patch. This code is general for every patch.
2. The actual patch in the form of a *unified patch format*. This indicates only the lines in files that were changed (including some context lines).

From the second section you could read which files were/are affected by the patch. You need to upload these files again to your FTP.

### Applying without bash/shell

If you can't run `.sh` files (in Windows), then you could extract the second section of the patch (the *unified patch*) and apply it manually [with a patching tool][1].

### Patches in future releases?

The patches that are released right now apply to all versions that were already released. Of course, might Magento release a new version (major or minor). Then they will contain all security patches as Magento will also apply the patches to their development code base naturally (these patches even originate from that code base ;)).

  [1]: https://www.google.nl/#q=windows+apply+unified+patch