🔍 Read the full analysis: Black October 2026: Following AI Through A Month Of Cybersecurity Turmoil on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis by Thorsten Meyer reports record CVE disclosures and cryptocurrency losses in October 2026, alongside a smaller rise in flaws added to CISA’s exploited-vulnerability catalog. The evidence on AI is mixed: AI-assisted research found flaws that were patched, while attackers’ use of AI to exploit fixes is a claim the figures do not establish on their own.
October 2026 set records for public vulnerability disclosures and reported cryptocurrency losses, but the number of flaws added to the U.S. government’s catalog of vulnerabilities known to be exploited rose much less sharply, according to a November 1 review by Thorsten Meyer. The figures show a widening gap between published flaws and documented exploitation, complicating claims that AI is already driving a broad surge in successful cyberattacks.
Meyer says the National Vulnerability Database (NVD) published 17,060 new CVE records in October, excluding rejected records, compared with 4,273 in October 2025. From January through October, his count was 89,859, against 39,639 over the same period a year earlier. The count depends on the method: including rejected records raises October’s total to 17,481. CVE records document disclosed vulnerabilities; they do not show that a flaw was exploited or that each record represents a distinct attack.
The U.S. Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog’s additions reached 282 from January through October 2026, above the 245 added during all of 2025. Five of October’s 36 entries were older vulnerabilities, dated from 2015 to 2023, for which new exploitation evidence had emerged, Meyer reports.
Crypto losses also reached a reported high. CertiK counted $3.47 billion in October losses after accounting for funds frozen and returned, compared with $68 million in October 2025. Meyer says the Binance theft accounted for 96.7% of the month’s total. On October 31, the FBI attributed that theft to North Korea’s “TraderTraitor” group. The source describes more than $6 billion leaving Binance in a single evening on October 29; the relationship between that gross figure and CertiK’s net-loss estimate is not fully explained in the material.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Documented Exploits
The different measures tell different stories. Public disclosures grew far faster than additions to CISA’s catalog: October CVE records quadrupled year over year, while KEV additions rose from 31 to 36. That does not show that the disclosure surge is harmless; it does mean a record number of published flaws should not be reported as a record number of attacks.
For security teams, the KEV list offers a more direct signal of flaws with evidence of active exploitation, although it is not a complete census of attacks. The October entries included software and devices used at network boundaries and for remote access, among them products from Ivanti, Citrix, Palo Alto Networks, Fortinet, Cisco and BeyondTrust, according to Meyer. The review also notes vulnerabilities in products including PHP and Google’s Brotli compression library. Organizations must weigh the evidence of exploitation alongside the systems they actually use.
The crypto figure underscores a separate risk. A large public loss can dominate a month’s headline total without showing that the month’s broader software vulnerability disclosures caused it. Meyer says the Binance incident began with a compromised laptop, rather than an AI-discovered software flaw. The report therefore supports concern about security pressure, but not a simple account in which AI caused every major incident.
Products Worth Considering
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Amazon Kindle Scribe (32GB) with Premium Pen, Tungsten
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames the month through three ledgers: disclosed vulnerabilities, documented exploitation and reported crypto theft. A CVE is a public record that a vulnerability exists. CISA’s KEV catalog identifies flaws for which the agency has evidence of exploitation in the wild. Crypto-loss estimates track a different kind of event and may be revised as funds are frozen or returned. The figures should not be treated as interchangeable measures of cyber risk.
The review attributes some of the swelling CVE total to changes in how records are assigned. Google’s Threat Intelligence Group (GTIG), cited by Meyer, said descriptions mentioning the Linux kernel alone produced about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation for that group. GTIG also said it observed about one in 431 vulnerabilities disclosed in 2026 being exploited, and reported only a moderate increase in average monthly zero-days, from eight to 11. Those are attributed findings, not a direct count of every attack.
The review also points to AI-assisted vulnerability research. Meyer says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He says PHP flaws known as PHP2Shell were found through OpenAI’s Patch the Planet program and patched on October 21. Google’s Big Sleep, he reports, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples concern finding and fixing flaws; they do not by themselves establish how often attackers used AI.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, in the November 1 review
AI’s Role in Attacks Remains Unsettled
The figures do not establish that AI caused October’s overall rise in cyber incidents. More CVEs do not necessarily mean more exploitation, and Meyer cites GTIG’s finding that only a small share of 2026 disclosures had been observed exploited. The source argues that attackers can use AI to turn fixes into exploits quickly and says an embargo on PHP2Shell broke before release, but the supplied material does not provide enough detail to independently assess the timing, method or broader prevalence of that activity.
The Binance account also needs careful handling: the source gives a gross figure of more than $6 billion leaving the exchange and a CertiK estimate of $3.47 billion in October losses after frozen and returned funds. It does not fully reconcile those measures. Nor does the source establish that the two figures use the same accounting basis. The FBI attribution is reported, but further investigative details and the status of any recovery are not provided.
Finally, the NVD and KEV counts are snapshots shaped by publication practices, inclusion rules and the dates records were added. CISA’s catalog is evidence-based, but it is not a complete measure of all exploitation. Whether the October patterns continue, and how much AI changes attackers’ capabilities relative to defenders’, remains unknown.
Watch Exploitation and Follow-Up Data
The next useful test is whether later monthly data show exploitation rising alongside disclosures, rather than only a growing number of published records. Updates to CISA’s KEV catalog and subsequent threat-intelligence reporting can show whether more of October’s disclosed flaws acquire evidence of active use. Comparisons should keep the same time windows and counting methods.
Further reporting on the Binance incident may clarify the theft’s mechanics, the relationship between the gross funds movement and net-loss estimates, and whether assets were recovered. Security teams should also track vendor advisories and patch status for products named in the October KEV additions. The available review establishes a record-heavy month and several documented AI-assisted research examples; it does not settle whether AI has produced a sustained increase in successful attacks.
Key Questions
What cybersecurity records did October 2026 set?
Thorsten Meyer’s review says the NVD published 17,060 new CVE records in October, excluding rejected records, and CertiK counted $3.47 billion in crypto losses after frozen and returned funds. The supplied figures do not show a matching record increase in CISA’s exploited-vulnerability catalog.
Did known exploitation rise as quickly as vulnerability disclosures?
No. CISA added 36 flaws to its Known Exploited Vulnerabilities catalog in October, up from 31 a year earlier, while the NVD’s October CVE count rose from 4,273 to 17,060. The two measures track different things and should not be treated as equivalent.
What role did AI play in the reported security findings?
The review describes AI-assisted research that found flaws later patched, including PHP flaws associated with OpenAI’s Patch the Planet program and work by Google’s Big Sleep. It also claims attackers can use AI to turn fixes into exploits, but the supplied evidence does not establish how widespread that practice was in October.
Who did the FBI blame for the Binance theft?
According to Meyer, the FBI attributed the theft to North Korea’s TraderTraitor group on October 31. The supplied material does not provide further investigative details or explain the difference between the reported gross funds movement and CertiK’s net-loss figure.
Source: ThorstenMeyerAI.com
