German web host Mittwald has traced a breach of customer projects to its MCP server, an interface for connecting its mStudio control panel to AI assistants. An attacker exploited a flaw in the server on October 27, read access tokens belonging to customers who used it and went on to compromise 56 projects. Mittwald detected the attack on November 4, eight days later.
MCP, the Model Context Protocol, is an open-source standard for connecting AI applications to outside systems. Each stolen token gave access to mStudio with its owner’s rights, including the projects that customer could reach. Robert Meyer, Mittwald’s founder and managing director, described the attack in a blog post on November 7.
An Attacker Who Started as a Regular Customer
According to Meyer, the attacker first tested a vulnerability in the MCP server on the evening of October 21, when much of the industry was busy with the PHP2Shell flaws in PHP. From October 23, the attacker moved around the platform as a regular user, registering test accounts, using extensions and making simple injection attempts.
On October 27, the attacker registered another account and exploited the flaw five minutes later. Mittwald’s logs show the attacker moving through its systems very quickly. At times, only seconds passed between steps that would take a human much longer. The company reads this as a sign that AI tools were used. The attacker also staged diversions, which first drew the team’s attention.
Eight Days to Detection, Then a Lockdown of the Panel
The attacker disguised the preparations with actions that looked like normal user behavior, which is why the attack went unnoticed until November 4, according to Mittwald’s FAQ. The company spotted unusual behavior in one of its systems on the morning of November 4 and blocked the attacker’s first account. It took parts of its systems offline as a precaution, identified the MCP server as the entry point and shut it down. The mStudio panel was back that evening. In Mittwald’s account, customer websites stayed reachable throughout the day.
Shortly after midnight, Mittwald blocked the projects that showed traces of the attacker. On November 5, it also suspended new account registrations, mStudio logins, SSH access to customer projects, Mittwald extensions and orders. External forensic specialists joined the analysis, and the company informed the relevant authorities. By November 6, it had forensically examined the 56 compromised projects and the MCP server, and repeated scans found no further compromised projects.
On November 7, Mittwald reopened mStudio and SSH access, and customers can now set up passkeys for mStudio. As of its latest update, the websites it blocked as a precaution remain blocked. Mittwald’s other panel, the Kundencenter, which serves its agency server, CMS and shop hosting products, and the websites managed there were not affected at any point, according to the company.
Stolen Tokens and What Affected Customers Should Do
Mittwald’s FAQ specifies that the attacker read session tokens from the MCP server, not passwords. The company has since revoked the tokens and also blocked API keys as a precaution. Mittwald found no sign that customer data had been published after checking the relevant platforms, and it continues to check. If it finds signs that files, databases or mailboxes in a customer’s projects were accessed, it will inform that customer directly.
Under Mittwald’s current assessment, customers who never used the MCP server are not affected, and the company emails each affected customer personally. It treats the server as taken over from October 27, so any use of it after that date counts as potentially compromised. Mittwald recommends that affected customers change their mStudio password and turn on two-factor authentication. They should also check API keys, project tokens and SSH keys, delete entries they do not recognize and look for SSH users they did not create. Credentials for third-party services stored in their projects, such as databases, mail and external APIs, should be renewed, and the other users of their projects informed.
If a project has to be restored from a backup, Mittwald will discuss with the customer which changes made since October 27 to carry over. For agencies, the company has published template texts to send to their own clients.
The MCP Server Stays Offline
The MCP server will stay offline until further notice. Mittwald will decide whether, and in what form, to offer the interface again once the investigation ends, and it points customers to the Mittwald command-line tool in the meantime. So far, the company has located the flaw in its MCP server and closed it.
Meyer expects AI attacks to become more common. Mittwald plans to publish a detailed account of the events during the week of November 9, once its analysis and recovery are complete.
