Unturned Roadmap 2026: Source Code Released, and a Workshop RCE Patched

The two things that actually mattered for Unturned in 2026 both landed in July: Smartly Dressed Games released the game’s full source code, and an emergency patch closed a remote code execution exploit that was being delivered through a workshop mod.

Last updated 26 August 2026. Every date below is from the studio’s own posts; nothing here is inferred.

The source code release, and what it does not mean

On 7 July 2026 Smartly Dressed Games published Unturned’s source code and project files on GitHub, alongside a FAQ, modding documentation and a demo showing a heat-seeking missile being added. The studio framed it as placing the future of the game in the community’s hands.

For server owners this is a modding and total-conversion story, not a hosting change. Your server still runs the official build the same way it did before. What changes is the ceiling on what community projects can do, and over time, the kind of mods you may be asked to host.

The workshop RCE: what happened

This is the part worth understanding properly, because it is the clearest recent example of workshop content being a server-side risk.

• On 29 July SDG received a report of a remote code execution exploit in a malicious server’s workshop mod.
• As a precaution they temporarily disabled all Internet server listings while preparing a fix.
• Patch 3.26.3.5 shipped the next day, preventing components from loading UnityEvents connected to static methods, which could be abused to call restricted methods such as Application.OpenURL.
• SDG stated they believe impact was limited to a single small server, and credited a community scan of the past month of workshop uploads that found no other use of the exploit.
• Follow-up patches 3.26.3.6 through 3.26.3.8 fixed regressions, including 3.26.3.7 taking a less extreme approach that restored most of the content the first fix had blocked.

What server admins should take from it

The practical lesson is about workshop trust, not about panic:

• Stay current. The mitigation lives in the game build. A server left on 3.26.3.4 does not have it.
• Curate your mod list. The attack vector was a mod delivered by a server to its own players. Mods from unknown authors deserve the same scrutiny as any other third-party code you run.
• Expect brief listing outages. SDG disabled Internet server listings platform-wide as a precaution. That is the correct response, and it means a listing outage is not always your server’s fault.

Update cadence

Unturned ships small, frequent, credited patches: 3.26.3.3 in June, 3.26.3.4 in early July, then the security line through early August. Patch notes are published to the Unturned Steam news feed and typically credit the community members who reported each issue, which makes them a reliable signal of what is actually being fixed.

Bottom line

Unturned in 2026 is a stable game with an unusually open future: the source is public, the patch cadence is steady, and the one significant incident of the year was handled in a day. Run the current build, curate your workshop mods, and the rest is routine.