Questions about the official Magento Security patches (SUPEE-xxxx)
Magento releases security patches as patch(.sh) files instead of as a new version. Always apply all patches that are available for your version even on a fresh installation!
- Since 2015, detailed information about the patch releases is found at the merchant docs here: http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/patch-releases-2015.html
- Magento CE patches can be downloaded at http://www.magentocommerce.com/download (you have to be logged in to download them)
- Magento EE patches are found in your Magento customer account at http://www.magentocommerce.com/products/downloads/
- Get news from Magento about the latest security updates via Magento Security Alert Registry at https://magento.com/security