The Record reports that German web hosting provider Mittwald CM Service disclosed in a Saturday blog post that hackers compromised 56 customer projects after going undetected on its systems for eight days [1]. According to the report, managing director Robert Meyer said the attackers exploited a flaw in the Model Context Protocol (MCP) server that lets customers connect AI assistants to the mStudio platform, and that logs suggest AI tools were used, though no other evidence was provided [1]. Mittwald customers should watch for the detailed account the company plans to publish next week and check whether their projects are affected [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
HighMonitoringMedia reported
Attacker exploits MCP server used for AI assistant connections at German host Mittwald, lurking eight days and breaching 56 customer projects
1 min read
- Disclosed
- Nov 7, 2026
- Published
- Nov 10, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
What to do nowOur advice
Mittwald customers should watch for the detailed account the company plans to publish next week and check whether their projects are affected [1]
Timeline
- Mittwald says no further attacker activity detected as of Friday[1]
- Mittwald discloses compromise of 56 customer projects in a blog post[1]
- Mittwald hit by second attack; website in emergency mode, SSH and admin interfaces disabled again[2]
heise online reports Mittwald restricted its MCP server, mStudio, SSH, mittwald Extensions and ordering system on Nov 5 after the MCP-server attack and gradually restored them by Nov 7; on the night of Nov 12 a second attack made SSH, mStudio and the customer center inaccessible again, and the company website was also affected and is in emergency mode. Mittwald confirmed the outages on its status page, told customers hosted websites are not affected by the shutdown, called the attackers evidently AI-assisted professionals and said it will share countermeasure details once completed.
Technical details
Remediation
Vendor guidance
- 1Check affected projects verify[1]
Mittwald customers should check whether their projects are affected and watch for the detailed account.
References
Media2
- [1]
“Mittwald CM Service, a hosting provider for web agencies based in North Rhine-Westphalia, disclosed in a blog post Saturday that hackers had compromised 56 customer projects after going undetected on its systems for eight days.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.