Just a day ago, a severe remote code execution (RCE) vulnerability in the PC multiplayer component for Dark Souls 3 was shared online. The person that discovered the exploit used it against a few different streamers, including The__Grim__Sleeper, in order to raise awareness to the issue. The person that discovered the vulnerability supposedly informed developer FromSoftware about the issue months ago but was ignored.
It was quickly revealed that the RCE vulnerability was not limited to just Dark Souls 3. The same vulnerability exists in Elden Ring, as discovered from information gathered from jailbroken PlayStation 4 consoles that could still access the Elden Ring beta. From there, it was also revealed that the same vulnerability exists in all previous Dark Souls titles. These include Dark Souls: Remastered, Dark Souls: Prepare to Die Edition, and Dark Souls 2.
FromSoftware finally took this issue seriously following the influx of reports and media attention yesterday. Earlier today, the PvP servers for all Dark Souls titles on PC were taken down and disabled. This is supposedly a temporary measure while the team takes time to "investigate recent reports of an issue with online services."
FromSoftware notes that the PvP servers for Xbox and PlayStation are not affected by this downtime.
