Source code for both CS:GO and TF2 dated 2017/2018 that was made available to Source engine licencees was leaked to the public today. pic.twitter.com/qWEQGbq9Y6— Steam Database (@SteamDB) April 22, 2020
This code was originally leaked privately in early 2018 by a source at Valve who wanted to "cause damage to" the company.
So why is it just coming out now? Retaliation.
The source of the current leak was recently removed from a modding group run by Tyler McVicker of Valve News Network. This modding group was working on a recreation of Valve's cancelled F-Stop project, which went on to become Portal 2. The source had access to the aforementioned 2018 private code leak and made it public in retaliation for being kicked out of the group.
CS:GO has officially commented on this issue, saying they have
not found any reason for players to be alarmed or avoid the current builds of the game, and also redirecting players to the Valve security page.
We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018. From this review, we have not found any reason for players to be alarmed or avoid the current builds.— CS:GO (@CSGO) April 22, 2020
Valve has not yet commented on how this leak affects Team Fortress 2 as of writing this, however there have been some unsubstantiated reports on Twitter about remote code execution, and servers such as Creators.TF have been taken offline, just to be safe.
Update: The official Team Fortress Twitter account has copy-pasted the CS:GO tweet, repeating that Valve has
not found any reason for TF2 players to be alarmed or avoid the current builds, adding that they
will update news outlets and players if we find anything to prove otherwise.
We will continue to investigate the situation and will update news outlets and players if we find anything to prove otherwise. In the meantime, if anyone has more information about the leak, the Valve security page (next tweet) describes how best to report that information.— Team Fortress 2 (@TeamFortress) April 23, 2020