🔍 Read the full analysis: Black October 2026: Understanding AI’s Role On Both Sides Of The Fight on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 report by Thorsten Meyer says October 2026 set a monthly record for published CVEs and saw $3.47 billion in crypto losses, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. The figures show a sharp gap between disclosures and documented exploitation; the source points to AI-assisted vulnerability research and faster exploit development, but does not establish that AI caused the month’s overall rise in attacks or losses.
A November 1 report by Thorsten Meyer says October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, while the U.S. Cybersecurity and Infrastructure Security Agency added 36 flaws to its Known Exploited Vulnerabilities catalog. The figures point to a sharp rise in vulnerability disclosures, but much smaller growth in cataloged exploitation; evidence cited by Meyer shows AI assisting some vulnerability research and exploit development, not that it caused October’s overall surge.
Meyer says he queried the National Vulnerability Database API on the morning of November 1, counting records by publication date and excluding rejected entries. On that basis, October’s 17,060 CVEs were four times the 4,273 recorded in October 2025. From January through October, the report counts 89,859 CVEs, compared with 39,639 over the same period last year. Including rejected records would bring October’s count to 17,481, according to the source.
A different measure, CISA’s KEV catalog, added 36 vulnerabilities in October, compared with 31 in October 2025 and 17 in 2024. The catalog lists flaws for which there is reliable evidence of active exploitation. Its 282 additions in 2026 through October already exceed the 245 added during all of 2025. The report also says five October additions were older flaws, dating from 2015 to 2023, for which new exploitation evidence had emerged.
For crypto losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. The report says the Binance incident accounted for 96.7% of the October total. On October 31, the FBI attributed the theft to North Korea’s TraderTraitor group, according to Meyer’s account. The source says more than $6 billion left Binance in a single evening on October 29; the two figures use different descriptions and accounting, and the report does not reconcile them.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The distinction between published flaws and actively exploited flaws is central to judging the month’s security risk. A CVE record documents a disclosed vulnerability; it does not by itself show that attackers have used it. The report’s comparison—October CVE disclosures rising fourfold year over year while KEV additions rose from 31 to 36—shows that the disclosure surge was much larger than the increase in vulnerabilities newly cataloged as exploited.
That gap does not mean the disclosed flaws are harmless. Security teams may face more work to identify which systems are affected and prioritize fixes, while attackers can target a smaller set of exposed products. The report names remote-access systems, firewalls, support tools and widely used software among October’s KEV additions. It also cites Google’s threat intelligence group as estimating that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited, while cautioning that automated assignment policies and large groups of low-signal records can inflate disclosure totals.
For readers and organizations, the evidence supports paying attention to exploitation and patch status, not just record-setting CVE counts. It also argues for caution when attributing a breach or theft to AI: the report connects AI to some research and exploit activity, but says the Binance incident began with a compromised laptop rather than an AI-discovered flaw.
Products Worth Considering
Hyperice Hypervolt 2 Pro Handheld Percussion Massage Gun
LEVOIT Vital 200S-P Smart Air Purifier for Large Rooms
BowFlex Results Series SelectTech Adjustable Dumbbells (Pair)
As an affiliate, we earn on qualifying purchases.
How Meyer Separated the Measures
Meyer frames October as a test of his view that AI is accelerating both vulnerability discovery and attacks on software. He separates the evidence into three measures: disclosed vulnerabilities in the NVD, flaws listed as exploited in CISA’s KEV catalog, and publicly counted crypto losses. Those measures describe different events and cannot be treated as interchangeable counts of “hacks.”
The report notes that annual CVE totals had already risen before October: from January through October, the count was 32,466 in 2024 and 39,639 in 2025, before reaching 89,859 in 2026. Meyer also cites Google’s threat intelligence group, which said exploitation had risen roughly in step with disclosures over a longer period and reported 141 distinct vulnerabilities both disclosed and exploited from January through August 2026, above the 127 recorded for all of 2025. That broader measure differs from monthly additions to CISA’s catalog.
For AI-related vulnerability work, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He also says PHP flaws patched October 21, referred to as PHP2Shell, came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples document contributions to finding or fixing flaws; they do not establish that AI caused the overall CVE increase.
““Some of it supports my view. Some of it does not.””
— Thorsten Meyer
What the Figures Cannot Show
The report does not establish that AI caused October’s record number of CVE publications, the rise in cataloged exploitation or the Binance theft. It presents examples of AI-assisted research and says attackers can use AI to turn fixes into exploits within days, but the material provided does not give a measured rate, comparison group or complete account of the alleged AI-assisted exploit activity. Meyer’s forecast of more hacks and larger CVEs is explicitly presented as his view, not a measurement.
The figures also have limits. NVD totals depend on counting methods and can include large sets of records generated under automated assignment policies; the report says about 5,000 Linux-kernel-related CVEs were recorded from January to August with zero observed zero-day exploitation, citing Google’s threat intelligence group. KEV additions reflect catalog entries, not every exploit in circulation. The source does not explain the difference between its statement that more than $6 billion left Binance in one evening and its CertiK-based October loss estimate of $3.47 billion after frozen and returned funds.
The report says the FBI attributed the Binance theft to North Korea’s TraderTraitor group, but the material supplied does not describe the FBI’s supporting evidence or the incident’s technical sequence. It also does not quantify how much of October’s vulnerability research or exploitation involved AI, or how many disclosed flaws were fixed before attackers could use them.
Patch Priorities and Further Evidence
The immediate security task is to identify affected products and apply fixes for vulnerabilities with evidence of exploitation, including the flaws added to CISA’s KEV catalog. The report describes October’s catalog additions as spanning internet-facing gateways, security appliances, remote-support products and other widely used software. Organizations will need to compare those entries with their own systems and follow vendor and government guidance.
Further reporting would need to clarify the Binance incident’s loss accounting and technical details, and provide more evidence on the role AI played in both vulnerability research and exploit development. Meyer’s report supplies a one-month snapshot and cites longer-period figures from Google’s threat intelligence group; subsequent NVD and KEV updates can show whether the October pattern continues. Until then, the central finding is a record disclosure month alongside a more modest rise in cataloged exploitation, with AI’s overall effect still unquantified.
Key Questions
What set a record in October 2026?
Thorsten Meyer’s count of NVD records shows 17,060 CVEs published in October, excluding rejected records. The report compares that with 4,273 in October 2025 and says the count would be 17,481 if rejected records were included.
Did exploitation rise as much as disclosures?
No. CISA added 36 flaws to its Known Exploited Vulnerabilities catalog in October, up from 31 in October 2025, while the reported CVE count quadrupled year over year. The measures track different things, and KEV entries cover flaws with reliable evidence of active exploitation.
Did AI cause the Binance theft?
The source does not say that. Meyer reports that the FBI attributed the theft to North Korea’s TraderTraitor group and says the incident began with a compromised laptop, not an AI-discovered vulnerability. The material provided does not include the FBI’s detailed account of the incident.
What evidence links AI to vulnerability research?
Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm. He also cites PHP flaws linked to OpenAI’s Patch the Planet program and Google’s Big Sleep research. These examples show involvement in some security work, but do not measure AI’s share of all October disclosures or attacks.
Source: ThorstenMeyerAI.com
