Unity's 10-Year-Old Security Flaw Wipes Out Fallout Shelter, Grounded 2, and Dozens More from Steam

Unity's Decade-Old Vulnerability Rocks Steam: Fallout Shelter and More Vanish

A startling security flaw, lurking for a decade within the ubiquitous Unity game engine, has sent ripples through the digital storefronts, causing a temporary exodus of dozens of popular titles from Steam. Among the most prominent casualties are beloved games like Fallout Shelter and the recently released Grounded 2. While titles already in players' libraries remain accessible, developers are strongly advising users to uninstall them as a precautionary measure.

The Critical Flaw and Its Widespread Impact

The vulnerability, discovered in the engine's Runtime code, presents a significant threat, impacting all Unity versions from 2017.1 right up to the latest Unity 6 release. This isn't a minor glitch; it's a critical weakness that Unity itself officially warned about in early October. The concern is that malicious actors could exploit this flaw to upload dangerous files onto users' systems or gain unauthorized access to sensitive local data. The scope of this threat is truly cross-platform, affecting Windows, Android, macOS, and Linux operating systems.

Developers React Swiftly to Safeguard Players

In response to this grave security concern, developers are taking swift action. Many are opting to temporarily remove their affected games from digital storefronts until they can implement the necessary fixes. Obsidian Entertainment, for instance, has proactively pulled its new releases and other titles such as Grounded 2 (in its early access phase), Pentiment, Avowed, and Pillars of Eternity from sale. While exact timelines for their return are uncertain, the studio emphasizes this is a temporary, albeit crucial, step to prioritize user safety. It's a poignant reminder of the delicate balance between rapid game development and robust security.

Beyond Unity: An Unexpected Reach

What's particularly surprising is the vulnerability's reach beyond games built purely on Unity. For example, Avowed, which primarily utilizes Unreal Engine 5, experienced a delisting due to its digital artbook being developed with Unity. Similarly, companion apps for games like Starfield and Oblivion Remastered, which likely incorporate Unity elements, also faced removal. This highlights how interconnected modern game development can be, with components from different engines potentially creating unforeseen attack vectors.

A Broad Spectrum of Affected Titles

The list of games affected by this widespread issue is extensive and includes a mix of AAA titles and indie darlings. Beyond Fallout Shelter and Grounded 2, other notable games that have been temporarily pulled or are under scrutiny include Pentiment, Wasteland Remastered, Wasteland 3, Pillars of Eternity 2: Deadfire, Knights and Bikes, The Bard’s Tale Trilogy, The Elder Scrolls: Blades, The Elder Scrolls: Castles, Hearthstone, and Warcraft Rumble. The sheer diversity of this list underscores the pervasive nature of the Unity engine in the gaming landscape.

A Growing List of Patched Games and Future Outlook

Fortunately, the situation is not entirely stagnant. Several games have already received crucial updates to address the vulnerability. Marvel Snap, No Rest for the Wicked, Ingress, Fate/Grand Order, Persona 5: The Phantom X, and Overcooked! 2 are among those that have deployed patches. Some independent developers have even labeled their recent updates simply as "Unity security update," signaling their commitment to player security. While the full extent of the damage remains to be seen, one thing is abundantly clear: any game developed using Unity 2017.1 or later is potentially at risk. Players should remain vigilant, prepared for temporary disappearances of their favorite games from Steam and for unexpected updates rolling out, even to older titles, as the industry rallies to close this decade-old security loophole.