I posted a write-up here: https://blog.nns.ee/2026/08/26/project-zomboid-vulns/

They were very fast to patch it. The patch actually removed loadstring (among the other fixes), which broke a bunch of mods for a while. The vulns themselves could also theoretically be abused by malicious mods, which unfortunately seems to be more commonplace these days.