3.26.3.5 Patch Notes — Unturned Steam update #355704

Yesterday evening we received report of a remote code execution (RCE) exploit in a malicious server's workshop mod. As a precaution, we temporarily disabled all Internet server listings while we prepared and released this patch. At this time, we believe the impact was limited to a single small server.Our sincere thanks to celeb for reporting the exploit, to Jdance for creating a proof-of-concept test case (initially reported through the community Discord), and to Daniel Willett for running a scan of the past month of workshop uploads to check whether this exploit had been used anywhere else (fortunately, it was not)!FixedPrevent loading components with UnityEvents connected to static methods. These could be exploited to call restricted methods such as Application.OpenURL. (By default, the game filters third-party URLs.)Edit: another patch, 3.26.3.6, has been released to fix an error when...