The short version
- On November 2, 2026, Valve released an update for the original Left 4 Dead (2008) that "fixed several crash and remote code execution exploits".
- Remote code execution (RCE) means an attacker can make your PC run their code over the network. In a game, that can be as simple as you joining a server or lobby they control.
- It usually starts with a memory bug in how the game reads data from other players, such as a buffer overflow.
- It's happened to big names: Dark Souls PC servers went offline in January 2022, and the original Modern Warfare 2 was pulled in July 2023 over a self-spreading worm.
What Valve changed
The Left 4 Dead patch notes are one line long: the update "fixed several crash and remote code execution exploits". Valve didn't say who reported them, how they worked or whether anyone had used them against players. The update covers the first game only; the Steam notice doesn't mention Left 4 Dead 2.
That's typical. Companies rarely publish details of a security fix, because it would hand a recipe to anyone running the old version. What's unusual is the game's age. Left 4 Dead came out 18 years ago and has long been overshadowed by its sequel, but it still runs on Steam's servers and community servers, and that's enough to make an RCE worth fixing.
What "remote code execution" means
Every program on your PC is just a list of instructions. Normally, the only instructions your computer runs are the ones you installed: Windows, Steam, the game itself.
RCE is when someone elsewhere on the internet gets your computer to run their instructions instead. "Remote" means they don't need to touch your PC. "Code execution" means they're not just crashing the game, they're running a program of their choosing with the same permissions the game has.
That's why security teams rate RCE as the most serious type of bug. Once an attacker can run code, they can try to install malware, steal saved passwords or browser cookies, or use your PC to attack others.
How a game gets hijacked, step by step
Online games constantly receive data from other people's machines: player positions, chat messages, custom sprays, map files, voice data. The game has to read and store all of it. Here's how that goes wrong:
- The game sets aside a fixed box of memory, called a buffer, for an incoming message. Say it expects a player name of up to 32 characters.
- The attacker sends something bigger. Their modified game or server sends a "name" that's thousands of characters long.
- The game doesn't check the length. Older code written in C or C++ often copies data without confirming it fits, so the extra data spills past the end of the buffer into the memory next to it. That's a buffer overflow.
- The overflow overwrites something important. OWASP, a widely used security reference, describes the classic case: the spill overwrites the "return address", the note that tells the program where to go next when it finishes a task.
- The program jumps to the attacker's code. The attacker has set that address to point at instructions hidden inside their own oversized message. When the game moves on, it runs them.
Modern systems have defences that make this harder, such as marking data memory as non-runnable and shuffling where things sit in memory. Attackers chain several bugs together to get around them, which is why one crash bug on its own can still matter.
Image: Zerocade
Why older multiplayer games are riskier
- Old code, written before today's habits. Games from the 2000s were built when nobody expected hobbyists to pick apart their network code for years.
- Players connect to each other directly. Peer-to-peer matchmaking and community-run servers mean you're receiving data from strangers' machines, not just the developer's servers.
- Fewer people watching. Once a game stops getting regular updates, a newly found bug can sit unfixed for months or years.
Real cases from the last few years
| When | Game | What happened | Response |
|---|---|---|---|
| Jan 2022 | Dark Souls 3 and older Dark Souls games (PC) | A researcher showed that players connected to your game could send data that ran code on your PC. They say they'd reported it to Bandai Namco in December 2021 | PC PvP servers switched off on January 23, 2022, for months. Consoles weren't affected |
| Jul 2023 | Call of Duty: Modern Warfare 2 (2009, PC) | Players reported a self-spreading worm in modded lobbies, flagged by antivirus as Wacatac | Activision took Steam multiplayer offline on July 26, 2023 to investigate |
| Mar 2024 | Apex Legends (ALGS North America finals) | Two pro players were given wallhacks and an aimbot mid-match. Early claims blamed an RCE, but later reports pointed to the players' PCs being infected instead | Finals postponed. Easy Anti-Cheat said its software wasn't the cause |
The Apex case is a useful reminder that not every "RCE" headline turns out to be one. The Dark Souls case shows the opposite problem: the person who found it says they'd waited weeks for a fix before demonstrating it publicly.
Image: Zerocade
How to stay safe
- Keep games updated. Patches like Valve's only help if you install them. Steam does this automatically unless you've turned updates off.
- Be careful with old games on community servers. For a game that no longer gets patches, stick to servers you know, or play offline.
- Don't run unknown mods, maps or "cheat" files. Many attacks never need an RCE; they just need you to run something yourself. Our infostealer explainer covers how fake downloads do this.
- Watch for official warnings. When a developer switches off servers or posts a security notice, stop playing online until there's a fix.
If you still play Left 4 Dead online, make sure Steam has downloaded the November 2 update before you join your next campaign.
