🔍 Read the full analysis: AI On Both Sides: Inside Black October 2026’S Cybersecurity Fight on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports 17,060 CVE records published in October 2026 and $3.47 billion in crypto losses, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. It also describes AI-assisted vulnerability research and faster exploit development, but the figures do not establish that AI caused the month’s records or the Binance theft.
October 2026 brought a sharp rise in published vulnerability records and reported cryptocurrency losses, while confirmed additions to the U.S. government’s actively exploited flaw catalog rose much less steeply. In an account published November 1, Thorsten Meyer says the National Vulnerability Database recorded 17,060 new CVEs during the month and CertiK counted $3.47 billion in crypto losses; the figures document a high-pressure month for defenders, but do not show that AI caused either record.
Meyer says he queried the National Vulnerability Database API on November 1, counted records by publication date and excluded rejected records. On that basis, October’s total was about four times October 2025’s 4,273. From January through October, the count reached 89,859, compared with 39,639 over the same period in 2025. Including rejected records would raise October’s total to 17,481, highlighting that the count depends on the method used.
A separate measure was less dramatic. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. Its 2026 additions reached 282 by the end of October, above the 245 added during all of 2025. KEV entries are flaws for which CISA cites evidence of exploitation; they are not a count of every disclosed vulnerability or every cyberattack.
For cryptocurrency losses, Meyer cites CertiK’s October estimate of $3.47 billion after frozen and returned funds, against $68 million in October 2025. He says the Binance incident accounted for 96.7% of October’s total. The FBI attributed the theft to North Korea’s TraderTraitor group on October 31. That attribution is an official assessment, not evidence in this source that AI was used in the theft.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Rose Faster Than Exploitation
The figures matter because vulnerability disclosure, confirmed exploitation and financial losses measure different risks. The jump in CVEs signals a larger volume of published records for security teams to triage, but it does not mean the same number of flaws are being attacked. CISA’s 36 October additions were up from 31 a year earlier, a much smaller change than the increase in published CVEs.
Meyer cites Google Threat Intelligence Group data saying exploitation has risen broadly alongside disclosure over a longer period, while only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That ratio is the group’s reported measure, not a guarantee that unlisted flaws are safe: catalog inclusion depends on available evidence and reporting. The gap cautions against treating a CVE record as proof of an active attack.
For organizations, the practical concern is the time between disclosure and exploitation. Meyer argues attackers can use AI to turn fixes into exploits within days, and says an embargo on the PHP2Shell flaws broke before release. The supplied material does not provide a detailed timeline or independent evidence for that claim. Still, it describes a defensible operational issue: teams may have to prioritize exposed systems and apply patches quickly, even as the overall disclosure count rises faster than confirmed exploitation.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker, Black
Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Three Counts Differ
Meyer separates the month into three ledgers: CVEs disclosed, flaws listed as actively exploited, and money stolen in crypto incidents. A CVE is a public identifier and record for a vulnerability; it does not itself establish that attackers used the flaw. CISA’s KEV catalog is narrower, listing vulnerabilities for which the agency says there is reliable evidence of exploitation. Crypto-loss estimates track a different outcome and can change when funds are recovered or frozen.
The source also describes AI-related security work in October. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He attributes the PHP flaws patched on October 21, referred to as PHP2Shell, to OpenAI’s Patch the Planet program. He also reports that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples indicate AI’s role in research and vulnerability discovery, not that AI caused the overall CVE surge.
The source’s account is an analysis based on public databases and cited company or agency findings, rather than a comprehensive audit of every October incident. It also notes that automated assignment policies can affect CVE totals. Google’s threat intelligence group reportedly found about 5,000 CVEs mentioning the Linux kernel from January through August 2026, with no observed zero-day exploitation among that set. That caveat helps explain why raw record totals can overstate changes in immediate attack activity.
““Some of it supports my view. Some of it does not.””
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Figures Cannot Prove
The figures do not establish that AI drove the increase in CVE publications, caused the rise in losses or was involved in the Binance theft. The source documents examples of AI-assisted research and asserts that attackers can use AI to develop exploits quickly, but it does not quantify how many October attacks involved AI or provide a comparison with prior months.
Several measurements also have limits. CVE totals vary according to whether rejected records are counted and how records are assigned. KEV additions capture documented evidence, not every flaw being exploited. The crypto total is attributed to CertiK and is reported after frozen and returned funds; the source does not set out the full incident-by-incident accounting. The supplied text also ends partway through its discussion of Google’s longer-term exploitation figures, so that section’s complete findings cannot be assessed here.
The FBI’s attribution of the Binance theft to North Korea’s TraderTraitor group is reported by Meyer, but the source provides no FBI statement text or technical evidence. Details of the alleged laptop compromise, the method used to move funds, and any role for AI remain unspecified in the material.
Tracking Patches and Exploitation
The next useful test is whether October’s disclosure surge is followed by a sustained increase in vulnerabilities with documented exploitation. CISA’s KEV updates can show which flaws have reached that threshold, while later NVD counts will reveal whether October was an outlier or part of a continuing rise. Those measures should be compared using consistent date ranges and counting rules.
Organizations will also be watching patch timelines for vulnerabilities tied to exposed services, including the remote-access, security-appliance and software products listed in October’s KEV additions. The source points to PHP2Shell as an example of AI-linked research and an alleged pre-release disclosure breakdown, but further details would be needed to establish exactly when the flaw became public and how quickly it was exploited.
For the Binance incident, the source gives the FBI attribution date but no subsequent recovery or investigation milestone. Updates from investigators, the exchange and blockchain analysts would clarify the loss estimate, the compromise path and whether funds were frozen or returned after the accounting. Until those details emerge, the October data supports a distinction between more flaws being published and a smaller, separately measured rise in confirmed exploitation.
Key Questions
What cybersecurity records did October 2026 set?
According to Thorsten Meyer’s November 1 report, the NVD published 17,060 new CVE records in October, while CertiK counted $3.47 billion in crypto losses after frozen and returned funds. CISA added 36 flaws to its KEV catalog; the source does not characterize that monthly figure as a record.
Does the CVE increase mean attacks quadrupled?
No. The reported fourfold comparison is between October 2026’s 17,060 published CVEs and October 2025’s 4,273. CVE records describe disclosed vulnerabilities, not the number of attacks. CISA added 36 vulnerabilities to KEV in October, up from 31 a year earlier.
Did AI cause the Binance theft?
The source does not say that. Meyer reports that the FBI attributed the theft to North Korea’s TraderTraitor group and says the incident began with a compromised laptop. The material provides no evidence that AI was involved.
What AI-related security work was reported?
Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm. He also attributes the PHP2Shell flaws to OpenAI’s Patch the Planet program and reports that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months.
What should readers watch for next?
Watch whether later CISA KEV updates show a continued rise in documented exploitation, and whether subsequent NVD counts sustain October’s disclosure level. Further reporting on the Binance investigation and the PHP2Shell disclosure timeline could clarify details the source does not establish.
Source: ThorstenMeyerAI.com
