Alleged AI-aided attack exploits MCP server flaw to breach German web host Mittwald (56 customer projects compromised)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5558 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MCP Server Injection-Style Probing and Error Bursts (Mittwald MCP Incident)

Behavior-first hunt for the exploitation pattern reported in TL-2026-5558: simple injection attempts and error-heavy, multi-path request bursts against an internet-facing MCP server (mcp.mittwald.de/mcp) and its OAuth bridge (auth.mcp.mittwald.de). Mittwald reported injection attempts on 2026-10-23 and exploitation of an unspecified MCP flaw on 2026-10-27 (T1190), preceded by probing (T1595). The flaw itself is undisclosed, so this rule keys on injection-style URI content and error bursts per source rather than a specific exploit signature. Note: MCP JSON-RPC bodies are not visible in access logs; pair with application-level MCP tool-call logging where available.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595
• Data sources: web_access_logs (index=web, sourcetype=access_combined), reverse_proxy_or_waf_logs (Sentinel CommonSecurityLog), webserver (Sigma logsource category)
• Severity: high
• Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-24h (host="mcp.mittwald.de" OR host="auth.mcp.mittwald.de" OR uri_path="/mcp*") | eval src_ip=coalesce(src_ip,clientip,src) | eval inj=if(match(coalesce(uri_query,""),"(?i)(union.{1,6}select|%27|[.][.]/|%2e%2e|[$][{]|[{][{]|;.{0,3}(whoami|curl|wget))"),1,0) | eval err=if(status>=400,1,0) | fillnull value="-" user | bin _time span=5m | stats count AS reqs sum(inj) AS inj_hits sum(err) AS errs dc(uri_path) AS paths values(status) AS statuses BY _time src_ip user | where inj_hits>=3 OR (reqs>=30 AND errs>=10 AND paths>=5) | table _time src_ip user reqs inj_hits errs paths statuses

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has 'mcp.mittwald.de' or RequestURL has '/mcp'
| extend Inj = iff(RequestURL matches regex @'(?i)(union.{1,6}select|%27|[.][.]/|%2e%2e|[$][{]|[{][{]|;.{0,3}(whoami|curl|wget))', 1, 0)
| summarize Reqs = count(), InjHits = sum(Inj), UniqueUrls = dcount(RequestURL) by SourceIP, bin(TimeGenerated, 5m)
| where InjHits >= 3 or (Reqs >= 30 and UniqueUrls >= 10)
| project TimeGenerated, SourceIP, Reqs, InjHits, UniqueUrls

Sigma

title: Injection-Style Request Content Against MCP Server Endpoints
id: 7c3e5a10-4b2d-4f8e-9a61-d2e0b5c73a11
status: experimental
description: Detects injection-style payload fragments (SQLi, path traversal, template/shell injection) in requests to MCP server endpoints, matching the simple injection attempts reported in the Mittwald MCP server incident (TL-2026-5558). Burst thresholds are implemented in the SPL/KQL flavors.
references:
  - https://www.mittwald.de/blog/mittwald/sicherheitsvorfall-am-mcp-server
  - https://therecord.media/cyberattack-germany-ai-mittwald
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: webserver
detection:
  selection_target:
    - cs-host|endswith: 'mcp.mittwald.de'
    - c-uri|startswith: '/mcp'
  selection_inj:
    cs-uri-query|contains:
      - '%27'
      - 'union select'
      - 'union%20select'
      - 'union+select'
      - '../'
      - '%2e%2e'
      - '${'
      - '{{'
      - ';whoami'
      - ';curl'
      - ';wget'
  condition: selection_target and selection_inj
falsepositives:
  - Authorized penetration tests or vulnerability scans against the MCP endpoint
  - Legitimate clients sending URL-encoded apostrophes in search parameters
level: high

Known false positives:

• Authorized vulnerability scanners or penetration tests against the MCP endpoint
• Legitimate API clients that URL-encode apostrophes in query parameters
• Developer load tests producing many 4xx responses from one source

Tuning notes: The access_combined host field is the logging server; if vhost is not logged, rely on uri_path=/mcp* and add the vhost to the log format. Allow-list scanner and pentest source IPs. Tune inj_hits and the reqs/errs/paths thresholds to the endpoint's normal traffic. Add MCP application logs (tool name, authenticated user) for body-level injection visibility.

• 🔒 Burst of OAuth Dynamic Client Registration / Account Signup Requests at MCP Auth Bridge · unlock with TL Creds
• 🔒 Web or App Server Process Spawning Shell or Downloader on Hosting Node · unlock with TL Creds
• 🔒 Machine-Speed Request Cadence Against MCP Endpoint With Browser-Like User-Agent · unlock with TL Creds
• 🔒 Scanner Tooling or Sensitive-Path Probing Against MCP Server Hosts · unlock with TL Creds
• 🔒 PHP Script or Web Shell Written Into Web Root by Shell or Download Utility · unlock with TL Creds
• 🔒 Connections to Community-Observed Sibling Infrastructure (Low-Confidence Watchlist) · unlock with TL Creds
• 🔒 New Account Registration Followed Rapidly by MCP Tool Activity · unlock with TL Creds
• 🔒 SSH Fan-Out Across Many Hosting Projects From One Source · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5558.

Sample indicators (2 of 6)

• Domain: mcp[.]mittwald[.]de
• URL: hxxps://github[.]com/mittwald/mcp-server

Defanged, TLP:CLEAR. Full set of 6 indicators: unlock with TL Creds.

Technical analysis

No CVE, malware name or attacker IOCs have been published.

Mittwald CM Service, a German hosting provider serving web agencies in North Rhine-Westphalia, disclosed on Saturday 2026-11-07 a security incident at its MCP server. The MCP server (public endpoint mcp.mittwald.de, fronted by an OAuth bridge at auth.mcp.mittwald.de) lets customers connect AI assistants to mStudio, the platform used to manage websites and hosting services. Per Mittwald's own timeline, the attacker first probed the MCP server on the evening of 2026-10-21, the same evening the PHP2Shell PHP vulnerabilities (CVE-2026-109618 / CVE-2026-109619) dominated IT news. On 2026-10-23 the attacker behaved like a regular user: registering test accounts, using extensions and attempting simple injections. On 2026-10-27 at 14:58 the attacker registered another account and at 15:03 used it to exploit the MCP server flaw.

Mittwald detected unusual behaviour in one system on the morning of 2026-11-04 (eight days after exploitation), blocked the first attacker account at 11:11, set its status page to investigation at 12:53, and took parts of the systems offline that evening, identifying the MCP server as the entry point and shutting it down. Early on 2026-11-05 projects carrying traces of the attacker were locked and new account registration was temporarily disabled; later that day mStudio login and SSH access to customer projects were blocked. On 2026-11-06 the 56 compromised projects and the MCP server were forensically analysed with external IT forensic experts, and repeated scans found no further compromised projects. mStudio and SSH access were restored on 2026-11-07 and passkey setup was introduced. Mittwald treats all data from 2026-10-27 onward as compromised; no specific data types or confirmed exfiltration were listed. The Customer Center and customer websites managed there were reportedly not affected. Relevant authorities were informed.

Mittwald attributes the speed of the activity to possible AI assistance: logs show only seconds between steps that would take a human attacker significantly longer, and the attacker disguised access attempts and used diversionary tactics. Mittwald offered no further evidence of AI use and did not respond when asked to distinguish AI tooling from conventional scripts, so the AI-aided characterisation remains alleged. It is also unclear whether the flaw lies in Mittwald's own code or in open-source MCP libraries. No link to PHP2Shell is established beyond timing. Mittwald has promised a detailed write-up the following week; this record should be updated when it is published. Note: Mittwald's open-source MCP server (github.com/mittwald/mcp-server) is documented as exposing 116 tools for managing hosting infrastructure with OAuth 2.1 Authorization Code + PKCE and Dynamic Client Registration; this describes the product, not the confirmed vulnerable component.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• No CVE or patch identifier published; Mittwald shut down and remediated its MCP server. Await the promised detailed write-up

Immediate actions

• Revoke and rotate credentials, tokens and SSH keys for any hosting project that Mittwald flagged as compromised
• Treat all data in affected mStudio projects from 2026-10-27 onward as compromised and review project contents for web shells or unexpected changes
• Follow Mittwald email/status-page instructions for blocked projects and re-enable only after review
• Audit and revoke OAuth grants/tokens issued to AI assistants connected to hosting or management platforms

Workarounds

• Disable or restrict MCP server connections to hosting management platforms until the flaw is fully documented
• Restrict SSH access to hosting projects to known source addresses where possible

Longer-term hardening

• Enforce least-privilege scopes for AI-assistant/MCP integrations and require human approval for high-risk tools such as SSH or file-write
• Rate-limit and monitor new-account registration and anomalous machine-speed request cadence against MCP endpoints
• Enable passkeys/MFA on hosting management consoles (mStudio now supports passkeys)
• Log MCP tool invocations with per-user attribution and alert on injection-style inputs

Affected and fixed versions

• Mittwald CM Service — Mittwald MCP server (mcp.mittwald.de) connected to mStudio hosting management platform

Timeline

• 2026-10-20 PHP maintainers issue an urgent notice on the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619); context only, no link to the Mittwald intrusion is established beyond timing.
• 2026-10-21 Attacker first tests a vulnerability in the Mittwald MCP server on the evening PHP2Shell dominates IT news.
• 2026-10-23 Attacker operates as a regular user: registers test accounts, uses extensions and attempts simple injections.
• 2026-10-27 At 14:58 the attacker registers another account; at 15:03 that account is used to exploit the MCP server flaw. Mittwald treats all data from this date as compromised.
• 2026-11-04 Unusual behaviour detected in one system; first attacker account blocked 11:11, status page set to investigation 12:53, parts of systems taken offline and the MCP server identified as entry point and shut down; mStudio back online that evening.
• 2026-11-05 Shortly after midnight projects with attacker traces are locked and new registrations disabled; later mStudio login and SSH access to customer projects are blocked; authorities informed.
• 2026-11-06 56 compromised projects and the MCP server are forensically analysed with external experts; repeated scans find no further compromised projects.
• 2026-11-07 Mittwald publishes its incident blog post; mStudio and SSH access restored and passkey setup made available.
• 2026-11-09 The Record reports the alleged AI-aided attack; Mittwald promises a detailed write-up the following week.

Sources cited

• Mittwald: Sicherheitsvorfall am MCP-Server mittwald.de · Vendor report · 2026-11-07
• Mittwald MCP Server listing (Glama) glama.ai · Research
• High-risk tools in Mittwald MCP Server (PolicyLayer) policylayer.com · Research
• mittwald/mcp-server (GitHub repository) GitHub · Code repository
• Alleged AI-aided cyberattack exploits assistant interface to breach German web host The Record · News · 2026-11-09
• The Record: PHP script vulnerability warnings (PHP2Shell context) The Record · News · 2026-10-21

More in data breach

• Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform
• Railway cloud platform breach exposes customer secrets, leads to $740,000 in fraudulent AI charges (Wiz 'Black October' campaign)
• NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents
• BYOD Ransomware Group Allegedly Claims Toyota Data Breach (Unverified)
• York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)

Previous and next in data breach

• Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens Previous report
• Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records) Next report