GERMAN WEB HOSTING PROVIDER MITTWALD HIT BY CYBERATTACK THROUGH AI ASSISTANT INTERFACE, 56 CUSTOMER PROJECTS COMPROMISED

ESPELKAMP, GERMANY — German web hosting provider Mittwald CM Service disclosed on November 7, 2026, that an attacker exploited a security vulnerability in its Model Context Protocol (MCP) server, gaining unauthorized access to internal systems and compromising 56 customer projects. The intrusion remained undetected for approximately eight days before the company identified suspicious activity on November 4. Mittwald believes the attacker may have used artificial intelligence tools to accelerate the operation, although the precise technology involved has not been independently established.

Mittwald, a North Rhine-Westphalia-based hosting provider serving web agencies and businesses, operates the mStudio management platform, which allows customers to administer hosting environments, websites, and related services. Its MCP server provided an interface through which customers could connect AI assistants to their hosting accounts. The vulnerability exploited during the attack affected this integration, creating an unauthorized pathway into portions of the company’s infrastructure.

According to Mittwald managing director Robert Meyer, the attacker first tested a weakness in the MCP server on October 21, during a period when the broader technology industry was responding to separate PHP vulnerabilities known as PHP2Shell. Beginning October 23, the individual operated through ordinary user accounts, registered test accounts, interacted with platform extensions, and attempted basic injection techniques. On October 27, the attacker registered another account at approximately 2:58 p.m. and exploited the identified MCP vulnerability five minutes later.

Analysis of the company’s system logs revealed unusually rapid activity following the intrusion. Meyer reported that certain operations occurred within seconds of one another, despite ordinarily requiring considerably more time for a person to perform manually. Mittwald interpreted this speed as an indication that AI tools may have assisted the attacker. The company also identified attempts to disguise unauthorized access and conduct diversionary activities that initially drew investigators’ attention away from the full intrusion.

The available evidence does not establish which AI tools, if any, were used. Automated scripts and conventional intrusion frameworks can also execute operations at high speed, making timing alone insufficient to conclusively identify AI involvement. Mittwald has not publicly identified a specific model, malicious AI agent, or confirmed AI-generated exploit responsible for the breach. The technical origin of the MCP vulnerability, including whether it originated in Mittwald’s implementation or an underlying software dependency, also remains unresolved in the company’s initial disclosure.

On November 4, Mittwald’s internal monitoring detected unusual behavior within one of its systems. The company blocked the attacker’s first identified account at approximately 11:11 a.m. and began an expanded investigation involving internal security specialists. By 12:53 p.m., administrators had escalated the incident on the company’s public status page and initiated additional containment measures. Investigators identified the MCP server as the intrusion point, disabled the interface, and revoked access pathways associated with the attack.

Containment measures continued into November 5, when Mittwald restricted projects containing evidence of unauthorized activity, temporarily suspended new account registrations, and disabled mStudio logins and Secure Shell (SSH) connections to customer projects. These restrictions were intended to prevent additional unauthorized access while investigators examined the affected infrastructure. External digital forensics specialists joined the investigation, and the company notified the relevant authorities.

By November 6, investigators had forensically examined 56 compromised projects and the affected MCP server. Repeated security scans did not identify additional compromised projects, and Mittwald reported that it could no longer detect active attacker operations within its systems. The company restored mStudio access and reenabled SSH connections by November 7, although websites previously restricted as a precaution remained suspended pending further evaluation.

Mittwald stated that its separate customer center and the websites managed through that environment were not affected by the incident. The company also reported that hosted web projects remained accessible throughout the initial response. These findings concern the availability and security of specific platform components and do not establish that every category of information within the 56 compromised projects remained inaccessible to the attacker.

Mittwald has adopted a precautionary approach to the incident, treating data associated with the affected environment from October 27 onward as potentially compromised. The company confirmed that attackers obtained session tokens associated with users of its MCP interface, allowing access to mStudio under the permissions assigned to those accounts. Mittwald stated that passwords were not exposed and that the compromised tokens had been revoked. Its investigation found no evidence that stolen information had been publicly released, although examinations of individual customer projects remain ongoing to determine whether additional files, databases, or other information were accessed.

The intrusion raises significant security questions surrounding the integration of AI assistants with administrative infrastructure. Model Context Protocol enables AI applications to communicate with external systems through standardized interfaces. When those connections possess administrative permissions, vulnerabilities in authentication, authorization, session management, or server-side implementation can potentially expose sensitive operations beyond an assistant’s intended scope.

The Mittwald incident demonstrates the operational risks of introducing additional software interfaces into hosting environments that already manage sensitive customer resources. The confirmed intrusion originated through an MCP server, but the company’s initial findings do not establish that the MCP standard itself was compromised or that customer AI assistants independently performed malicious actions. The security failure involved an exploitable access pathway, with the exact underlying weakness still awaiting detailed technical disclosure.

Mittwald has indicated that a more comprehensive account of the attack will be published following completion of its forensic investigation and recovery work. The company is also continuing to assess whether additional customer notifications or protective measures are necessary. Its response includes the availability of passkey authentication for mStudio accounts following restoration of the management platform.

For hosting providers and organizations deploying AI-connected administrative tools, the incident reinforces the importance of limiting interface permissions, monitoring unusual account activity, isolating management services, and maintaining reliable methods for revoking compromised access. The ability to connect an AI assistant to operational infrastructure introduces additional security responsibilities, particularly when those integrations can interact with customer hosting resources.

Mittwald CM Service — Robert Meyer, “MCP Server Security Incident” (Sicherheitsvorfall am MCP-Server), November 7, 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE