Unturned has no coverage on this site to extend. The nearest neighbour in the corpus is the Garry’s Mod 64-bit migration guide, and the difference is the direction of the reader: that piece tells an addon author whether their code survives a rebuild, while this one tells a player whether a server and its mod list are worth joining — on a game whose developer has documented its servers, its mod format and its anti-cheat in public.
Smartly Dressed Games published the game’s source code and project files on 7 July 2026, and the announcement feed since then reads like a security log: a remote code execution report in a server’s Workshop mod, a banned Workshop file, a fake lobby ID, and three patches ending with the same paragraph of advice.
What this covers: what the 7 July 2026 source release actually grants, the six security patches the announcement feed carries between 30 July and 30 September 2026, and the five signals a player can check before joining a server. Why it matters: the shortest join path — a Server Code — is documented as skipping the pre-join screen that lists a server’s installed mods, and it is the same path the patch notes warn about. Who should care: anyone joining public servers from invites, server owners choosing what to declare in their listing, and mod authors working out whether the public tree changes their obligations.
The release grants a non-commercial SDK, not the game
The 7 July post is short. “Unturned’s source code and project files are now freely available,” it reads, with a link to the U3-SDK repository on GitHub and a screenshot captioned “Playing Unturned’s Russia map from within the Unity scene editor.” The same post points at the FAQ, and the FAQ is where the release stops being a giveaway.
| Question | What the SDG documentation says | What it means for a player |
|---|---|---|
| Is the game open source now? | “Open Source refers to the Open Source Initiative’s definition, which the current non-commercial license doesn’t meet” | The tree is public, the licence is not permissive |
| Can a mod be sold? | “No, sorry, it must be strictly non-commercial.” Players “must be able to play and access all features and content of your mod for free” | A paywalled mod breaches the licence |
| Is all the code there? | “certain code we can’t redistribute has been removed. For example, third-party pathfinding and anti-cheat libraries” | The anti-cheat is not in the repository |
| Are the game’s assets included? | “the core asset bundle has been intentionally excluded from the SDK” because it “contains some third-party licensed content” | Skins and audio are not reusable, and SDG says it cannot list which are third-party |
| Must a mod publish its code? | “No, you can keep your mod’s code private if you wish” | A closed-source mod is legitimate under this licence |
Two rows carry most of the weight. The tree does not make Unturned auditable in the sense a security review would want, because BattlEye’s Unturned-specific code is absent — the FAQ says it is “still private (even we don’t have access to it)”. And the release added no new reason to distrust mods: one could already be closed-source and ship compiled asset bundles.
The quarter the patch notes describe
Six announcements between 30 July and 30 September 2026, all security work, in feed order.
| Date | Build | What the note itself says | What changed for a player |
|---|---|---|---|
| 30 July 2026 | 3.26.3.5 | “a remote code execution (RCE) exploit in a malicious server’s workshop mod”; “we temporarily disabled all Internet server listings” | Internet server listings went down while the patch was built |
| 3 August 2026 | 3.26.3.7 (and 3.26.3.8) | “Took a less extreme approach to blocking the exploit fixed in 3.26.3.5, restoring most content” | The first fix was stricter than needed; content came back |
| 28 August 2026 | 3.26.3.9 (and 3.26.3.10) | an exploit “that could affect players with the Steam Overlay disabled”; “not been used in the wild” | Two more patches in the same sequence |
| 3 September 2026 | 3.26.3.11 | “We have banned a Workshop file containing the exploit which had 1 active subscriber” | A Workshop file was removed and its uploader banned |
| 21 September 2026 | 3.26.3.12 | “Cheats using fake lobby ID to join other players’ groups” | A lobby identity could be spoofed to enter a group |
| 30 September 2026 | 3.26.3.13 | “New version of the BattlEye launcher resolves issues with Steam Overlay” | The anti-cheat launcher was updated |
3.26.3.5 is the one to read closely, because it documents both the mechanism and the cost. The fix was to “Prevent loading components with UnityEvents connected to static methods. These could be exploited to call restricted methods such as Application.OpenURL.” That is a rule about what a mod’s assets may contain, and a static method call is not something a player can look at and judge.
The cost sits in the same note’s “Missing Content” section: “Mods with ‘missing Item GameObject’ (or similar) errors unfortunately require an update from the mod creator.” It could not be gentler, because an event pointing at a deleted object and one crafted to reach a restricted method are “code-wise indistinguishable from an attempt to exploit the vulnerability, so it must be blocked.” Four days later 3.26.3.7 replaced that with a “less extreme” approach “restoring most content” — “most” is the note’s word, and no later announcement enumerates what stayed broken.
From 3 September the notes stop describing mechanisms and repeat advice. 3.26.3.11, 3.26.3.12 and 3.26.3.13 each close with the identical paragraph: “please use caution when accepting unexpected server invites or joining servers from people you do not trust. We have recently seen an increase in reports involving malicious Workshop content.” That is the most actionable sentence in the feed, and the documentation explains why it names invites.
The join path that skips the mod list
The Server Codes page and the browser documentation describe two doors into the same server, and they do not show the same information.
A Server Code is “a randomly generated, 17-digit numeric code assigned to your server”, usable from the Connect Directly menu without port forwarding. Its documented drawback is precise: “The primary downside of Server Codes is their incompatibility with the pre-joining server info screen (which displays things like the server name, installed mods, current players, and other details). The info screen uses Steam’s A2S protocol, which can only be queried by IP, so joining by Server Code enters the server immediately instead.”
The screen that lists installed mods before you commit is an A2S query, it needs an address, and a code-based join — the format most likely to arrive as an invitation from a stranger — goes straight in. The September notes warn about “unexpected server invites” in the same window in which 3.26.3.12 fixes a “fake lobby ID” being used “to join other players’ groups”.
Five things you can actually check
None is a guarantee. Each is documented, so each is a claim you can hold someone to.
| Signal | Where it is documented | What it establishes — and what it does not |
|---|---|---|
| The pre-join info screen | Server Codes page: shows “server name, installed mods, current players, and other details” via Steam’s A2S protocol | The list, before you load in — but only on an address join, not a code join |
| The server’s Monetization field | Server Hosting Rules: four values — Unspecified, None, NonGameplay, Monetized — and “Players can filter the in-game server list by this field” | A self-declaration. The rules say it “must be configured truthfully” when set, so a set field beats Unspecified |
| A Server Browser Curation list | Server Browser Curation: shared as a Workshop asset “or automatically downloaded from a URL on the Internet” | Rules that Allow, Deny or Label by name, IPv4 or ServerID — from a third party, not SDG |
| The map version shown for a server | Dedicated Workshop Update Monitor: “maps have their own version numbers which the server list uses to test compatibility before players connect” | Catches a stale map. Says nothing about the rest of the mod list |
| An anycast proxy behind the server | Server Hosting Rules: such servers “are flagged to sort like they have a higher ping” | Explains a browser ping that does not match in-game latency |
Two of those need a caveat the documentation supplies. A curation asset “is not enabled by default when subscribed to. It needs to be enabled from the Curation menu in the Server Browser”, so subscribing to a trusted list is not the same as using it. And that feature’s motivating case is a host wanting to stop “bad actors from copying your server details”, with example labels rendering as MyNetwork Verified and MyNetwork Imposter. It labels a server rather than inspecting it.
What the launch options add, and what they cannot
Four flags in the game’s documentation bear on Workshop risk, all added through Steam.
-NoWorkshopSubscriptions— “Disable loading of all Steam Workshop subscriptions. This can be helpful when troubleshooting issues.”-SkipAssets— “Disable loading asset bundles and Workshop content.”-OfflineOnly— “Disables requests to the internet. For LAN servers, it skips the Steam backend connection and uses locally-cached Workshop items.”-ValidateAssets— “Perform additional health checks on assets during start-up,” which the Asset Validation page expands: the slow tests log “to the Client.log file, as well as to the Asset Errors menu.”
Those give you a clean client and a readable asset log. They do not give you a verdict. -ValidateAssets checks whether navmeshes are CPU-readable, whether meshes and materials are missing, whether textures are power-of-two — structural health, not intent. A mod built to reach a restricted method passes all of it.
The server side has a documented exploit surface of its own. -EnableCharacterControllerOverlapRecovery is listed with the warning that it “makes out-of-bounds exploits much easier. This can cause more problems than it solves so it’s not enabled by default.” A server advertising unusually smooth performance may have traded validation for frames.
What SDG’s own rules say is out of scope
The Server Hosting Rules page draws the boundary of the system rather than describing its interior. The reportable list is short: selling “vanilla premium content”, promoting the sale of cheats, and roleplaying current real-world tragedies. The unreportable list is the one players hit first:
“Can I report servers for admin abuse or pay-to-win features? — This is not reportable. Unfortunately, the best option is to play on a different server, or to host your own multiplayer server for you and your friends. Moderating individual community servers is not tenable at our current small scale with current tools, but may be revisited if/when it becomes feasible.”
The page’s changelog records why that boundary sits where it does. A 3 June 2024 entry reads: “Scaled back the degree to which the server list is moderated. The previous level was untenable especially when considering anyone can freely create an unlimited number of servers, and the moderation system is duct-taped on top of the otherwise unmoderated Steam server list.”
That sentence is the right expectation to hold: the server browser is Steam’s list, SDG’s rules apply to what appears in it, and enforcement is a layer on top. The Monetization field, the anycast flag and curation lists exist to make a mostly unmoderated list legible, and all three depend on somebody declaring something.
Two mechanisms sit outside that, aimed at hosts and authors rather than players. Fake IP “routes traffic through Steam’s relay network, shielding your server’s IP”, and connecting by Server Code “utilizes Steam Datagram Relay (SDR)” so that “IP addresses are never revealed”. For mod authors, configuring an Asset Bundle Custom Data block to the original upload’s Workshop file ID “adds a verification check to when a server attempts to download the mod”.
What is not confirmed
- How much content the 3.26.3.7 relaxation restored. The note says “most content” and stops. No enumeration, and no later note revisits it.
- How many mods still miss content under the 3.26.3.5 rule. Affected mods “require an update from the mod creator”. No count exists.
- Whether a forked server appears in the public list. The FAQ says such servers “are not visible in our public server list, although it is technically possible to make them appear there.” No figures either way.
- Whether the August and September exploits are related. Both are described as separate reported exploits; nothing states a shared cause.
For scale, Steam’s live player-count endpoint returned 15,855 players for app 304930 when queried for this piece, a number that moves hourly. The store page prints 221,318 English-language user reviews at 90% positive.
A workable order for this week
- Join by address or through the browser, not by a code you were sent unprompted. The pre-join screen that lists installed mods is an A2S query, and A2S needs an IP. This costs nothing and restores the only pre-commit view of a server’s mod list.
- Read the Monetization field, and check your curation list is actually on. Unspecified is the default and is not an accusation; the rule is only that a configured field “must be configured truthfully”. A curation asset, meanwhile, is “not enabled by default when subscribed to”, so an unchanged browser means it is not applied.
- When browser ping and in-game ping disagree by a lot, suspect an anycast proxy. Such servers are deliberately sorted as if their ping were higher, so the anomaly is the system working.
- Keep a clean profile for testing, and set the fields you own.
-NoWorkshopSubscriptionsand-SkipAssetsboth exist as documented flags;-ValidateAssetsreads structure, not intent, and an author’s Workshop file ID check is the only mechanism here that verifies a download’s identity.
Unturned in late 2026 documents its failure modes better than it prevents them. Six security announcements in two months is a developer responding quickly; a rules page that says admin abuse is not reportable is a developer saying where the response ends. The public tree helps the people who can read it, and everyone else gets a handful of declared fields and one screen that appears only when you join the right way.