🔍 Read the full analysis: What AI On Both Sides Tells Us About Black October 2026 on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source reports that October 2026 brought a record 17,060 published CVE records and $3.47 billion in crypto losses, while CISA added 36 vulnerabilities to its exploited-flaws catalog. It also identifies AI-linked vulnerability research and rapid exploit development, but the figures do not show that AI caused the month’s broader rise in attacks or the Binance theft.
An analysis published November 1 says October 2026 set records for published software vulnerabilities and crypto losses, but the available figures do not show a matching surge in confirmed exploitation. The month’s data also includes AI-linked vulnerability research and reports of flaws being turned into exploits quickly, leaving the role of AI in the wider security picture unresolved.
Thorsten Meyer’s count of the U.S. National Vulnerability Database (NVD), based on its API and excluding rejected records, found 17,060 CVE records published in October. That is four times the 4,273 recorded in October 2025. From January through October, the count was 89,859, compared with 39,639 during the same period in 2025. The author notes that including rejected records would put October’s total at 17,481, underscoring that the method affects the count.
Evidence of exploitation rose less sharply. The Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog had 282 additions for 2026 through October, above the 245 added over all of 2025. The figures count catalog additions, not every attack or exploited flaw worldwide.
The analysis also cites CertiK’s estimate of $3.47 billion in October crypto losses after accounting for frozen and returned funds, compared with $68 million in October 2025. It says Binance accounted for 96.7% of the month’s total, and that the FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31. These are separate measures from vulnerability disclosures and exploitation; their coincidence in one month does not establish a common cause.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Three Security Measures, Different Signals
The headline numbers describe different parts of the security landscape. CVE records track publicly documented vulnerabilities, CISA’s KEV catalog tracks flaws for which the agency cites reliable evidence of active exploitation, and crypto-loss estimates track reported financial losses. Treating all three as a single measure of “hacks” risks overstating what the data confirms.
The gap between disclosures and catalog additions is central to Meyer’s analysis. October’s CVE count was four times its level a year earlier, while KEV additions rose from 31 to 36. That contrast suggests the disclosure surge did not translate into an equivalent rise in the catalog’s measure of exploited flaws. It does not establish that risk fell: the figures have different methods and coverage, and the KEV count is not a full inventory of attacks.
For organizations responsible for software and networks, the practical concern is that known, exploitable flaws can demand urgent remediation even when they are a small share of all disclosures. The analysis lists October KEV additions affecting remote-access products, security appliances, software platforms, PHP, and Google’s Brotli compression library. The catalog can help prioritize response, but it cannot by itself explain how many systems are exposed or which attacks succeeded.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How October’s Tallies Were Counted
Meyer says he queried the NVD API on November 1, counted records by publication date, and excluded rejected records. On that basis, October totals rose from 3,564 in 2024 to 4,273 in 2025 and 17,060 in 2026. January-to-October totals were 32,466, 39,639, and 89,859, respectively. The source cautions that CVE identifiers themselves are not a count of published vulnerabilities: numbering authorities can reserve blocks, while this tally counts published records.
The source also cites Google Threat Intelligence Group (GTIG) findings that automated assignment policies can inflate CVE totals. GTIG reportedly counted about 5,000 records mentioning the Linux kernel from January through August 2026 and observed no zero-day exploitation among them. In a September 30 account, GTIG said it counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. It also estimated that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. These are attributed findings with their own scope, not a complete census of exploitation.
On AI, the analysis says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including one flaw already exploited in the wild. It links the PHP2Shell flaws, patched October 21, to OpenAI’s Patch the Planet program, and says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. Those examples show AI’s presence in vulnerability research; they do not quantify AI’s overall effect on attacks.
““That is my view, not a measurement.””
— Thorsten Meyer, describing his interpretation
What the Data Cannot Establish
The figures do not establish that AI caused the CVE surge, drove the month’s exploitation, or played a role in the Binance theft. The source says attackers used AI to turn fixes into exploits within days and reports that the PHP2Shell disclosure embargo broke before release, but it does not provide a complete case-by-case dataset or quantify how often AI was involved.
The crypto-loss total is attributed to CertiK, and the FBI attribution of the Binance theft to North Korea’s TraderTraitor is reported by Meyer. The source does not provide enough detail here to independently assess the incident’s full mechanics or establish whether AI was involved. It says the theft began with a compromised laptop, an account that complicates any claim linking the largest loss to an AI-found vulnerability.
It is also unclear how much of the CVE increase reflects more vulnerabilities, changes in reporting or assignment practices, or other factors. The analysis itself notes that automated policies can raise counts and that totals vary depending on whether rejected records are included. October’s records are a snapshot, while exploitation may be identified and added to CISA’s catalog later.
Tracking Exploitation and AI Use
The next useful comparison will be whether CISA adds more October disclosures to KEV as evidence of exploitation emerges, and how later NVD counts change under consistent inclusion rules. That would help distinguish an expanded reporting pipeline from a lasting increase in vulnerabilities that attackers actually use. The analysis gives no scheduled update or official deadline for those comparisons.
For the AI question, stronger evidence would require documented cases showing what an AI system found or produced, when it was used, and whether it changed the speed or outcome of an attack or a security fix. Until such evidence is available, October’s examples support the narrower conclusion that AI tools are being used in vulnerability research and that exploit development can move quickly. They do not settle how much AI changed the month’s overall threat level.
Key Questions
What was the main finding about October 2026?
The analysis reports 17,060 published CVE records in October, alongside 36 additions to CISA’s exploited-vulnerabilities catalog. It describes a record disclosure month, but a much smaller increase in the catalog’s exploitation count.
Does the CVE record mean there were four times as many attacks?
No. The fourfold comparison is for published NVD records in October 2026 versus October 2025. CVE disclosures are not a count of attacks, and the source says CISA’s KEV additions rose from 31 to 36 over the same October comparison.
What role did AI play in the reported findings?
The source describes AI-linked security research, including Microsoft release entries crediting AI models or research firms, OpenAI’s Patch the Planet program, and Google’s Big Sleep work. It does not establish that AI caused the broader increase in CVEs or the Binance theft.
What is known about the Binance loss?
The analysis cites CertiK’s estimate of $3.47 billion in October losses, with Binance accounting for 96.7%, and says the FBI attributed the Binance theft to North Korea’s TraderTraitor. The provided material does not establish an AI connection to the theft.
Source: ThorstenMeyerAI.com
