Unturned 3.26.3.5 Patch Notes (30th July 2026)

Unturned's 3.26.3.5 patch arrived on 30th July as an emergency security response to a remote code execution vulnerability discovered in workshop content. The exploit allowed malicious mods to call restricted methods such as Application.OpenURL by leveraging UnityEvents connected to static methods, a technique that could have granted attackers significant control over player machines. The developer believes exposure was limited to a single small server, but the fix applies retroactively to all workshop content.

The practical consequence of this patch extends beyond the immediate vulnerability. The game now blocks any component with UnityEvents pointing to static methods, which means older mods with improperly configured event systems will fail to load. A follow-up patch, 3.26.3.6, was released the same day to handle a secondary issue: components that reference missing script files or objects now trigger validation errors instead of crashing silently. This creates a new problem for modders and server operators. Any custom item or object that relied on event-driven behaviour pointing to deleted or missing targets will vanish from affected servers until the mod creator updates their work. The developer notes this is unavoidable because the engine cannot distinguish between a misconfigured event and an exploit attempt.

For server operators running community-created mods, this patch introduces friction. The notes recommend checking error logs to identify which mods are affected, but the onus falls entirely on mod creators to release updates. Players will see missing custom items and objects until those updates arrive. The developer acknowledges this burden and provides modders with specific guidance: error logs will display the precise component and event causing the issue, sitting above the "missing GameObject" warning. This transparency helps, but only if mod creators are actively maintaining their work.

Internet server listings were temporarily disabled as a precaution while the patch was being prepared and tested, though they have since been restored. This measure prevented new malicious mods from being discovered and distributed during the vulnerability window. The patch credits celeb for the initial report, Jdance for creating a proof-of-concept test case through the community Discord, and Daniel Willett for scanning a month of past workshop uploads to confirm the exploit had not been weaponised elsewhere. That last detail matters: the vulnerability existed in the wild, but evidence suggests it was not actively exploited beyond the single server where it was discovered.

This patch represents a necessary security hardening, but it carries a cost for the modding ecosystem. Older or abandoned mods will silently break, and players on servers using such content will experience missing features without clear explanation. The fix itself is sound, but the transition period will frustrate both server operators and players relying on custom content.