Data basis: four official Project Zomboid announcements on the game’s Steam news feed — 18 March 2026 (updated 20 March), 8 April 2026 (two posts), and 26 August 2026 — read in full 2026-08-31 through Steam’s news API. Version numbers, device-count ranges and quoted phrases are taken from those posts. Nothing here comes from a third-party wiki, a mod site, or a reconstruction.
Most patch-note coverage of Project Zomboid in 2026 is about Build 42 finally reaching stable. Running underneath that, and never collected in one place, is a different sequence: four disclosed security events in six months, each of which forced a decision about which branches to keep alive. The most recent one, on 26 August, deleted two methods from the Lua modding API outright.
What was patched, and where
Project Zomboid does not ship one build. Through 2026 it has run up to four public branches at once, and each security event hit a different subset of them:
| Event | Stable | Unstable | outdatedunstable | Legacy (B41) |
|---|---|---|---|---|
| Mar 3 report | Patched same day | Patched same day | — | Removed from circulation |
| Mar 18 report + internal audit | 41.78.18 | 42.15.3 | 42.15.2 | Removed again, open-ended |
| Apr 7–8 Workshop exploit | 41.78.19 | 42.16.3 | Synced to unstable | Not vulnerable to this exploit |
| Aug 26 hotfixes | 42.20.4 | 42.19.2 | — | 41.78.21 |
The interesting cell is the bottom right. In March, The Indie Stone wrote that legacy versions “will remain unavailable,” that bringing them back was something the team was “exploring” but “unable to make any commitments” about, and that Build 42 stable had to come first. By 26 August, legacy is not only back — it is being hotfixed in the same announcement as the two live branches, under the version 41.78.21.
The announcements do not say when that reversal happened, and the feed contains no post for 41.78.20, so somewhere between April and August a legacy build shipped without its own announcement. That gap is why this page presents the March position and the August behaviour as two observed states rather than as a narrated change of policy.
The three months of branch removals
The March sequence is the clearest statement anywhere of how the team weighs coverage against safety. A modder, copiumsawsed, reported a significant vulnerability on 3 March. Stable and unstable were patched the same day. Legacy versions could not be patched in that window — so rather than leave them exposed, the studio pulled them from circulation entirely and patched them over the following days.
Two weeks later a second modder, Albion, reported a further issue while the team’s own internal audit
surfaced more. These were harder to fix. Legacy versions came out of circulation a second time, and this
time the post did not promise a return date. The studio also introduced a standing rule in the same
breath: outdatedunstable would from then on lag exactly one minor version behind unstable, so that a
rollback branch could never sit on a known-vulnerable build.
Both March posts state that these vulnerabilities “only affected mods,” and that the studio had seen no evidence of anyone being exploited in the wild.
April: the one that was actually exploited
The April event is different in kind. On 7 April the studio received reports of a Workshop mod generating malicious code. Investigation found heavily obfuscated code writing files outside the Project Zomboid directory, and then found that the same uploader had published 14 mods carrying the same exploit — all of them presented as music add-ons for a legitimate soundtrack mod, with names like Katana ZERO OST and Cowboy Bebop OST.
The studio’s own figures: those mods had been installed on between 500 and 2,200 devices. The uploader was banned and every affected mod delisted. The announcement is unusually direct about what uninstalling does not fix — because the mods could create files outside the game folder, “simply uninstalling the mods is not sufficient,” and affected users were told to take separate security measures.
Two clarifications in that post are worth carrying forward, because both were widely misread at the time. The exploit affected Build 42 branches only; Build 41 was not vulnerable to it, and the B41 security patch released the same day addressed a separate flaw found in the internal audit, with no evidence of exploitation. And the legitimate soundtrack mod these 14 add-ons attached themselves to was not involved, not authored by the same person, and not used as part of the exploit.
August: two methods deleted from the modding API
The 26 August hotfix is a single line of patch notes — “Fixed security vulnerabilities” — followed by a paragraph that matters far more to anyone running a modded save:
Mod makers should be aware that as part of this fix, the
loadstringandloadstreammethods have been removed.
loadstring compiles a string into a callable Lua function at runtime. Any mod that used it to execute
code sent from the server has to be rebuilt: the announcement’s instruction is to define the needed
methods ahead of time and have the server send commands that call them, rather than sending code to be
compiled on arrival. Mods that cannot be converted are directed to the studio’s Discord mod-portal
channel.
This is the pattern the whole year points at. Every disclosed Project Zomboid vulnerability in 2026 was in the modding surface, not in the base game’s networking or save handling — and the fix that finally stuck was not a patch to the sandbox but the removal of the capability that made the sandbox escapable. The cost lands on mod authors, and it lands on all three branches simultaneously.
What this means for a modded save right now
If you run mods on 42.20.4, 42.19.2 or 41.78.21, the practical checklist is short. Anything that broke on
or after 26 August and involves server-to-client scripting is a loadstring casualty rather than a bug —
the fix has to come from the mod author. Anything that broke in March or April is more likely one of the
“very low” number of mods the studio expected its earlier patches to affect. And if you installed a music
add-on from the Workshop in early April, the 8 April announcement’s list of 14 Workshop IDs is the
authoritative place to check, not a forum thread.
For the release-by-release view of the current stable line, see the 42.20 stable hotfix tracker. For what else changed between the branches, see which Build 41 knowledge expired in Build 42. For how mod breakage shows up in player sentiment, see why Project Zomboid reads 40% in Chinese.
What we could not confirm
- When legacy versions returned. March says open-ended removal; August ships 41.78.21 LEGACY. No announcement in the feed marks the reversal, and 41.78.20 has no post at all.
- What the August vulnerability actually was. The hotfix says “security vulnerabilities” and describes the mitigation, not the flaw. We do not speculate about the mechanism.
- What the April malicious files did. The studio’s own post says the “full scope and behavior of the malicious files have not been fully determined” at time of writing, and we found no later announcement updating that.
- How many mods broke in each event. March estimates the count as “very low” without a figure; August gives none. There is no published tally.
Sources
- Important Security Updates, 18 March 2026 (updated 20 March) — two reports from modders, legacy removals, branch versions 41.78.18 / 42.15.3 / 42.15.2, and the one-minor-version outdatedunstable rule
- Patching a Zero Day Exploit, 8 April 2026 — 14 Workshop mods, 500–2,200 devices, uploader banned, B42-only scope
- Stable (41.78.19) + UNSTABLE (42.16.3) Hotfixes Released, 8 April 2026 — the separate Build 41 security patch
- 42.20.4 STABLE & 42.19.2 UNSTABLE & 41.78.21 LEGACY Hotfixes Released, 26 August 2026 — removal of loadstring and loadstream, and the migration instruction for mod authors
