Our team has been working on the Project Zomboid multiplayer layer continuously since the Build 42 MP rollout in December, and 42.18.0 — now live on the unstable branch — is one we put significant effort into. The Indie Stone has framed this update as a modding and bug-fixing pass with some light balance changes, but the multiplayer section is by far the longest in the changelog, and most of our work this cycle is reflected there.
The biggest piece is a security and anti-cheat pass. The build closes a RakNet-level denial-of-service vulnerability, removes a subtle authentication weakness where the AutoCreateUserInWhiteList option could let a client log in to an existing character using only the username, and shuts down a set of item-duplication exploits — including a backpack-based dupe and one routed through forging. We also took the opportunity to retire the redundant Fire, Smoke, and XP anti-cheat passes; under the Build 42 systems they were producing more noise than signal, and removing them reduces both false positives and the surface area available for abuse.
The rest of our work this cycle shows up as a long list of stability and desync fixes that should be visible to anyone running or playing on a server. Players can now refuse a medical check, so AFK characters can no longer be killed by another player removing their bandages. Vehicle interactions are properly split along PVP status, the "distant vehicle" audio cue that lets you hear an approaching car from afar has been restored, and overencumbrance damage no longer accumulates roughly four times faster on MP than it should. A server crash from a remote vehicle colliding while towing a trailer, and a separate server hang during world save creation, have both been resolved — alongside resyncs for barricades, fire burning time, weapon bloody condition, dyed clothing, and a number of quieter cases.
For server administrators, the DisableSafehouseWhenPlayerConnected option has been renamed to DisableSafehouseWhenOwnerConnected to reflect what it actually does, the "Wars" setting now defaults to off, and IP logging has been restored to a dedicated text file excluded from logs.zip. The unstable branch is open for testing now, and we continue to iterate with The Indie Stone as community feedback comes in.