This month all old Magento stores are displaying this message on their backend:

"Read details" goes to Magento Download Page to download the latest security patches.

You can find here information about the general process.

Installation requires SSH, but we don't have access. What can we do? There is a solution.

First we need to apply changes on our test server, where we can access by SSH (or directly by console if we are in local environment)

After changes done, we must test everything and check that our shop is still working.

And now we have to upload the changes. There is a new file in app/etc called applied.patches.list. It contains all information about changed files. For example, this is the information from patch SUPEE-1533:

-e -n 2015-04-19 21:37:53 UTC | SUPEE-1533 | EE_1.12 | v1 | _ | n/a | SUPEE-1533_EE_1.12_v1.patch
patching file app/code/core/Mage/Adminhtml/Block/Dashboard/Graph.php
patching file app/code/core/Mage/Adminhtml/controllers/DashboardController.php

So we are looking at the files name. We only need to upload the files with FTP.

Don't forget to empty the cache when the update is done.