[Note: this patch went briefly live earlier this week, but it broke custom key bindings. We rolled it back, and that's fixed now.]
2025.8.e.3: "EAGLES"
A number of tiny ameliorations from the redoubtable Chelnoque
Perfected skills stop displaying upgrade slots
Films and phonograph records can no longer be contaminated
The cursor is anchored more thoroughly when trying to zoom right after moving the camera with keys
Verb windows now (again) resize correctly on slots removal
Better hitbox for a craftable recipe selection
Better support of ultrawide resolutions
Edge scrolling now retains consistent speed regardless of the zoom level
Fixed an assortment of bugs that occured during the key rebinding
In Severn Chamber, a certain comfort slot placement area was too short
In terrain unlock preview window, the period image was placed incorrectly when the preview description was only a single line
Various Japanese localisation fixes
Unity security update
Actually the Severn Chamber one was me, thanks to the player who wrote in to ask why they couldn't put their arthropod friend back where they found him. I don't know how we missed this for two years.
I'll talk briefly about the Unity security update, because you've probably seen, like me, a steady flow of updates in your Steam library, and most people are a bit vague about what it entails. (If you've read our Cultist Simulator update post, you already know these details, this post is almost identical.)
--
The short version: it's a vulnerability that seems to have been in Unity since 2017, but no one seems to have noticed or used it because it's pretty niche. So you probably dont have much to worry about even in unpatched games.
The long version: I'm not a cybersecurity bloke, but broadly as I understand it, there were command line flags in any game built with Unity that could be used to tell your game to load arbitrary code. Like this one:
bh.exe -overrideMonoSearchPath "C:\\somefolder\\ransomware.dll"
Importantly, they couldn't make the game load code from a remote location. So someone has to (a) get the code on to your machine or a local network path, then (b) convince you to run the relevant command line, which isn't straightforward. But on Windows, it's quite easy to register an application to open any URL in a specified format, like this
steam://getSteamToDoSomeConfigAction
So attacker tricks you into (a) registering "bookofhours://" as a schema and then (b) gets you to click a link like this
bookofhours:// -overrideMonoSearchPath "aSimpleHttpURLWouldntWorkButAttackerCouldPotentiallyGetCreativeAndMakeYouDownloadAFIle"
Windows tells Book to start running and supplies the -overrideMonoSearchPath as a launch parameter. Poor Book obediently tries to load the file supplied in the malicious link, maybe it works, and if it does, you're now running their code.
So again, someone still needs to convince you to run an app in the first place to register Book as a schema handler, maybe your AV software will flag the download, idk, but the Internet is rife with clever cyber bastards. And it's a bigger deal for a game that actually is registered as a schema handler for genuine reasons.
Either way, it's fixed now, for Book and a lot of other games! But there will be unmaintained games out there with the vulnerability forever, so maybe if someone's read this far, I've saved them a visit to the Misery Palace ¯\\_(ツ)_/¯
https://unity.com/security/sept-2025-01/remediation
https://www.kaspersky.com/blog/update-unity-games-cve-2025-59489/54542/