For: mittwald mStudio users (mainly German web agencies), and operators who run an MCP server that connects AI assistants to their own service. This article is based on mittwald's official blog post and FAQ. It does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
mittwald mStudio users (mainly German web agencies), and operators who run an MCP server that connects AI assistants to their own service.
- Confirmed so farSee the table ↓
- Entry point
- Compromised customer projects
- Period treated as compromised
4 more
- Discovery and shutdown
- Information read out
- Situation as of November 6
- Publication of data
Listed as possibly affected
- Use of AI tools
- Not yet confirmed
- Whether customer files, databases or mailboxes were accessed (the company says its review continues)
- The specifics and location of the flaw (the company's code or a library)
- The company's detailed report (planned for the following week)
2 more
- Whether the MCP server will return
- Whether AI tools were actually used (the company calls it a suspicion)
- What to do nowSee the steps ↓
- Check whether you are affected: did you use the MCP server, and did you get an email from the company?
- If affected: change the password and turn on two-factor authentication
- Review API keys, project tokens and SSH keys
3 more
- Rotate credentials for outside services and tell the people involved
- Ask the company about locked websites and backups
- MCP server operators: review your own setup
- Where to verify (source)All sources ↓
- mittwald, "Sicherheitsvorfall am MCP-Server" (official blog, in German; timeline through November 7)
- Last checked
- As of November 10, 2026
Follow-up plans and what we checked
The timeline in the company's blog runs through November 7, 2026. The company says it will publish a detailed account the following week, once its analysis and recovery are fully complete, and that until then it will share information through its status page and by email. When we checked on November 10, 2026, we found no such report yet.
What mittwald users and MCP operators should do today
Check whether you are affected: did you use the MCP server, and did you get an email from the company?
According to mittwald's FAQ, those affected are customers who used the MCP server, and they receive a personal email. If you never set up the MCP server and received no email, the company's current view is that you are not affected. Two-factor authentication is still recommended.
The company advises treating the account as potentially compromised if you used the MCP server on or after October 27, 2026, the day the attacker actually exploited the flaw.
If affected: change the password and turn on two-factor authentication
Following the company's guidance, change your mStudio password and enable two-factor authentication. Now that mStudio is available again, you can also set up a passkey. For passkeys, see What a passkey is; for the basics of multi-factor authentication, see Getting started with multi-factor authentication.
Review API keys, project tokens and SSH keys
This follows the company's guidance.
- Look through your list of API keys, project tokens and SSH keys, and delete anything you do not recognise
- In particular, look for SSH users you did not create yourself
- The company has revoked API keys as a precaution
How to handle SSH keys is covered in Least privilege for SSH keys.
Rotate credentials for outside services and tell the people involved
The company advises renewing credentials for third-party services such as databases, mail and external APIs. Tell the people who use your projects (your clients and team) as well.
The company says that where customers need to take further steps, it will inform them individually by email.
Ask the company about locked websites and backups
According to the company's FAQ, websites that were locked as a precaution are reopened one by one after a security scan finishes. If you restore from a backup, the company says the customer decides together with it which changes made since October 27 are kept. Contact channels and the status page are listed in the company's blog.
MCP server operators: review your own setup
What to check in your own MCP server in light of this incident is summarised below under "What operators of MCP servers should review".
What happened (from mittwald's announcement)
This section is based on mittwald's official blog post "Sicherheitsvorfall am MCP-Server" (Security incident at the MCP server) and its FAQ. Times are as the company states them. This is the company's own account and has not been verified by a third party.
October 21 (evening)
The attacker first tests a flaw in the MCP server. The company writes that this was around the same time as the discussion about PHP2Shell.October 23
The attacker starts acting as a regular user: registering test accounts, using extensions and trying simple injection attempts (the company).October 27, 14:58 to 15:03
The attacker registers another account at 14:58 and exploits the MCP server flaw at 15:03. The company treats all data from October 27 onward as compromised.November 4
In the morning the company notices unusual behaviour in one of its systems. It blocks the attacker's first account at 11:11 and sets its status page to "investigating" at 12:53. It identifies the MCP server as the entry point and shuts it down. In the evening mStudio is back online. Web projects stayed reachable throughout.November 5
Shortly after midnight the company locks projects with traces of the attacker, temporarily disables registration of new accounts, and during the day blocks mStudio login and SSH access to customer projects.During the investigation
External IT forensics specialists support the analysis, and the company informs the competent authorities.November 6
The company forensically examines the 56 compromised projects and the MCP server. Repeated scans find no further compromised projects, and it can currently detect no attacker activity. mStudio becomes usable again during the night.November 7
mStudio and SSH access are available again. Websites locked as a precaution stay locked for now. The company says the customer centre and the websites managed there were not affected. Passkey setup becomes available.
From October 21
Probing the flaw, test accounts
↓→
October 27
Flaw exploited, 56 projects
↓→
November 4
Discovered, MCP server shut down
- Entry point
- A flaw in the MCP server, which connects customers' AI assistants to the company's control panel mStudio
- Scope of compromise
- 56 customer projects. The company treats all data from October 27 onward as compromised
- What was read out (FAQ)
- Not passwords but session tokens of MCP server users, all revoked. With a token, the holder could access mStudio with that user's rights
- Not affected
- The customer centre and the websites managed there. The company says they were not affected at any time
- Data (FAQ)
- There is no sign that data was published on the internet, but the review continues. Customers for whom signs of files, databases or mailboxes being retrieved are found will be told individually. Without such a message, there is currently no sign of access to that project
- On the use of AI
- The company says the steps in its logs ran seconds apart, and, according to reports, the attacker moved through the systems very quickly. The company says this suggests the use of AI tools. This is the company's suspicion
- The company's response
- Blocking accounts and projects, disabling registration, blocking login and SSH, revoking access, shutting down the MCP server, repeated scans. External IT forensics specialists support the analysis. The competent authorities were informed
- Next
- The following week, once analysis and recovery are fully complete, it will publish a detailed account. Information will come through the status page and by email
What is known and what is not
The state as of November 10, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Entry point | A flaw in the MCP server | Confirmed (the company) |
| Compromised customer projects | 56 | Confirmed (the company) |
| Period treated as compromised | Data from October 27 onward | Confirmed (the company) |
| Discovery and shutdown | November 4; MCP server shut down | Confirmed (the company) |
| Information read out | Session tokens of MCP server users. Passwords not read. All revoked | Confirmed (the company FAQ) |
| Customer centre and sites managed there | Not affected | Not included (the company) |
| Situation as of November 6 | No further compromised projects found; no attacker activity detectable | Confirmed (the company) |
| Access to customer data (files, databases, mail) | Customers with signs of retrieval will be told individually; the review continues | Under investigation |
| Publication of data | No sign it was published on the internet | Confirmed (the company FAQ; review continues) |
| Use of AI tools | An inference from the speed in the logs; no direct evidence shown | Possible (the company) |
| Specifics and location of the flaw | Not published | Not stated |
| Return of the MCP server | To be decided after the investigation | Under investigation |
| Detailed report | Planned for the following week | Planned (the company) |
How to read this: the company's account has not been verified by a third party
The figure of 56 and the timeline come from the company's own investigation. The company says external IT forensics specialists are supporting the analysis, but their findings have not been published. The use of AI is a suspicion the company drew from speed, not a confirmed fact. Press reporting says it is also unclear whether the flaw was in the company's code or in an open-source library.
What can happen when an MCP server connects to customer environments
The following is general and does not mean these things happened here. What the company has published as having happened is limited to "What happened" above.
MCP (Model Context Protocol) is a way for AI assistants to call outside services. Connected to a service that can operate on servers and databases, such as a hosting control panel, an MCP server becomes an entrance for acting on behalf of users.
If authentication or input checks at that entrance have a flaw, the permissions the entrance holds can reach other users' tokens and operations. In this case, what the company says was read out was users' session tokens, and with a token the holder could enter the control panel with that user's rights. The wider the token's permissions, the more projects a flaw in a single entrance can reach.
What operators of MCP servers should review
This section does not evaluate the company's response, and it does not guess the content or cause of the flaw. From the published timeline and the general nature of MCP servers, it is limited to points to check in your own setup, and they are our view.
Scope the tokens you give the MCP server to each purpose
In this timeline, tokens that were read out became control-panel permissions as they were (company FAQ). Keep the tokens an MCP server receives or issues to what the AI assistant's task needs, such as read-only or a single project, and keep them apart from administrator rights. That makes the range of one leak smaller (our view).
Make tokens short-lived, and prepare revocation before an incident
The company responded by revoking every token that was read out. Shorter expiry shortens the time a leaked token can be used. Build and rehearse a procedure for revoking tokens in bulk before an incident (our view).
Catch the probing stage, before the real abuse
In the company's account there was a first test on October 21, test account registrations from October 23 and simple injection attempts, and the flaw was actually exploited on October 27. Alerts for bursts of new account registrations, abnormal errors on input and heavy calls from a single account might catch the probing stage (our view).
Treat speed as a signal of automation in your logs
The company took steps seconds apart as a clue to the use of AI tools. Whether or not it is AI, operations continuing from one account at a speed no human could keep up is useful for detection. Put a ceiling on the rate of operations per account, and stop or ask for confirmation when it is exceeded (our view).
Keep an alternative for when you shut the MCP server down
The company shut down the MCP server and points customers to its command-line tool (CLI) instead. Keeping a way to work that does not use MCP makes the decision to shut an entrance down faster (our view). Another case of AI acting autonomously in an attack is covered in The intrusion into Hugging Face.
Sources (public records)
The facts in this article come from the public information below. Attack step details are not covered.
- mittwald, "Sicherheitsvorfall am MCP-Server" (official blog, in German; timeline through November 7) — mittwald.de
- mittwald, "MCP-Server: Was du jetzt wissen musst" (official FAQ, in German; checked November 10) — mittwald.de
- The Record, "Alleged AI-aided cyberattack exploits assistant interface to breach German web host" (press report, supporting; November 9, 2026) — therecord.media
Update history
2026-11-10: First version. Based on mittwald's official blog post (timeline through November 7), its FAQ and press reporting. We will update when the detailed report the company plans for the following week is published.
Read next
- AI inference platforms breached: The NEAR AI inference engine flaw / The Fireworks AI security incident
- AI acting autonomously in an attack: The intrusion into Hugging Face (2026)
- A compromised distribution of AI tooling: LiteLLM 1.107.0 shipped a credential stealer
- When a hosting provider is breached: Responding to a hosting provider breach
- Multi-factor authentication: Getting started with multi-factor authentication / What a passkey is
- Other 2026 incidents: Data breaches and cyberattacks of 2026