Unturned's 3.26.3.7 patch notes are out, published August 3, 2026. The headline change: the exploit blocking from 3.26.3.5 has been toned down to a less extreme approach, restoring most affected content.

The update also fixes:

• Boombox links now open the original URL rather than the parsed URL.
• Async-loaded lightning and custom weather prefabs no longer skip the static Unity event check.
• An inconsistent ordering exception when a server prefab has multiple components of certain types.
• The Classic Canned Beans skin now works with Wild Harvest eating animations.

Community contributors credited in the notes: Jdance, PomPomSaturin, SomeAussieGamer, Daniel Willett, and Sultan.

Unturned's 3.26.3.5 patch notes, published July 30, 2026, address a remote code execution (RCE) exploit reported in a malicious server's workshop mod. As a precaution, all Internet server listings were temporarily disabled while the patch was prepared and released, and impact is believed to have been limited to a single small server.

Credit for the find goes to celeb, with a proof-of-concept test case created by Jdance and initially reported through the community Discord. Daniel Willett ran a scan of the past month of workshop uploads to check whether the exploit had been used anywhere else; it had not.

• Loading components with UnityEvents connected to static methods is now prevented. These could be exploited to call restricted methods such as Application.OpenURL; by default, the game filters third-party URLs.

A follow-up patch, 3.26.3.6, was released to fix an error when a component is missing its script during event validation and to ignore events that haven't been configured.

Mods with "missing Item GameObject" (or similar) errors require an update from the mod creator. Until then, certain custom items and objects may be missing from levels and servers.

In reviewed cases, the issue was event-related components referencing a missing target object — for example, an event configured to trigger a particle system that was later removed without updating the event. Code-wise, this is indistinguishable from an attempt to exploit the vulnerability, so it must be blocked.

Modders should check the error log file: above the missing GameObject warning should be a message with the precise component and event causing the issue.

💥SERVER IS ONLINE
-HEY HEY PLAYERS!
BIG DELIVERY of a new update on the server
What have we prepared for you?

🌵Caches have been added!
Now there are 9 points across the entire map where a buried treasure chest can spawn.
How do you get it?
You need to find a shovel and a map, after which you will have a marker on your map with the name "treasure":x:
Run there and hit the spot where the marker is located 3 times and you will see your chest with useful loot! After looting, the map and shovel break and you will need to find a new one.
Cooldown for searching is 1 hour.

🛡️The green safe zone generator now protects your base from raiding!
Do you remember that useless green generator? Now it has a use. Place it at your base, fuel it with glue or chemicals, and set the protection radius.
There are only 2 of them:
8 meters - reduces 75% of damage to the structure during a raid
16 meters - reduces 50% of damage to the structure during a raid
Also, to configure its mode you need a wrench for removing wheels. Can be found in the auto workshop.
When the fuel in the generator runs out, it will stop protecting your base and it can be broken or blown up faster.

😏Have a nice game on this project, thank you for being with us!

all details in our Discord "THE_FF Unturned - best server project"

I don't recommend coming here, offended admins play here who will immediately start looking for you if you kill them. In short, my friend killed an admin in the city, about maybe 20 minutes passed and I see some schoolkids hanging around the house and shouting, like if he doesn't come out, they'll destroy the house. I came out, asked what happened, they didn't really explain anything and immediately killed me. Then my friend teleported and started talking with them about what happened, in the end, the admin said that his ass was on fire, he fucked up his items, you couldn't kill him, he's like a god on this server. The next day they completely destroyed our houses and we stopped playing on this wonder project. Whoever wants to save their nerves and have a good time in summer, better not come here) And let the offended ones who got pushed around in real life and are trying to make up for it here keep playing.