🔍 Read the full analysis: Black October 2026: AI’s Part In A High-Stakes Cybersecurity Month on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, according to figures in the source report. But CISA’s exploited-vulnerability additions rose much less sharply, and the source’s evidence does not establish that AI caused the month’s overall spike in attacks or losses.
October 2026 set records for published vulnerability disclosures and reported crypto losses, while the number of flaws added to the U.S. government’s exploited-vulnerability list rose more modestly, according to a November 1 report by Thorsten Meyer. The figures document a high-volume month for security disclosures and theft, but they do not show that AI caused the overall increase.
Meyer said his count of National Vulnerability Database (NVD) records found 17,060 new CVEs published in October, excluding rejected records. That was four times the 4,273 counted for October 2025. From January through October, the report counted 89,859 records, compared with 39,639 over the same months of 2025. The report says its counts were drawn from the NVD API on November 1; including rejected records would raise October’s total to 17,481.
A separate measure showed a smaller increase in vulnerabilities with evidence of exploitation. The report says the Cybersecurity and Infrastructure Security Agency (CISA) added 36 flaws to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog had 282 additions through October 2026, exceeding the 245 additions recorded for all of 2025. The measures are not directly interchangeable: CVE totals count published vulnerability records, while KEV entries indicate evidence of active exploitation.
The report also cites $3.47 billion in October crypto losses, based on CertiK figures after frozen and returned funds were accounted for, versus $68 million in October 2025. It says the Binance incident represented 96.7% of the month’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” group on October 31. The source describes more than $6 billion leaving Binance in one evening on October 29, but the supplied material does not include the underlying FBI statement or a separate account of how the loss figure was calculated.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why the Three October Measures Differ
The figures matter because disclosure, exploitation and theft measure different events. A sharp rise in published CVEs can increase the volume of flaws organizations must assess and patch, but publication alone does not show that attackers have used those flaws. CISA’s KEV additions are a narrower indicator, based on evidence of exploitation, and the October increase was far smaller than the jump in CVE records.
Meyer’s report cites Google’s threat intelligence group as saying exploitation rose roughly in step with disclosure over its measured period, while only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. It also reports an average of 11 zero-days a month, up from eight. These figures complicate any claim that the record CVE count translates directly into a proportional rise in attacks.
For security teams, the practical issue is not the headline count alone, but how quickly organizations can identify which flaws affect their systems and whether credible exploitation evidence exists. The crypto figure points to a different risk: the report says the Binance theft made up nearly all of October’s counted losses, so the monthly total is heavily shaped by one incident rather than a broad measure of routine cyber activity.
Products Worth Considering
Apple MacBook Pro 16-inch (2021) with M1 Max, 64 GB RAM, 2 TB SSD – Space Grey
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How AI Fits the October Record
The report presents AI as a contributor to vulnerability discovery and repair, not as a proven cause of October’s overall security statistics. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It also says PHP2Shell, a group of PHP flaws patched on October 21, came from OpenAI’s Patch the Planet program.
Separately, the report says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples support the narrower point that AI-assisted research can help find bugs. They do not establish that AI generated the 17,060 CVE records, caused the Binance theft, or drove an overall increase in attacks.
The report argues that attackers can use AI to turn public fixes into working exploits within days and says the embargo around PHP2Shell broke before its release. It also notes a counterpoint: the source describes the Binance incident as beginning with a compromised laptop, rather than an AI-found vulnerability. The article is based on Meyer’s account and data; the supplied material does not include independent reporting or the full underlying datasets.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 report
What the October Data Cannot Establish
The figures do not establish that AI caused October’s record CVE total, the rise in KEV additions or the Binance theft. The source reports examples of AI-assisted vulnerability research and a claim that attackers used AI to adapt fixes into exploits, but it does not provide a complete count of incidents linked to AI or a comparison that isolates AI’s effect.
Some methodological details also limit comparisons. The report notes that CVE totals depend on counting choices and that automated assignment policies can inflate counts. It cites Google’s threat intelligence group’s estimate that roughly 5,000 CVEs mentioning the Linux kernel were generated from January through August 2026, with no observed zero-day exploitation for that group. The crypto-loss total, meanwhile, is dominated by Binance, and the supplied material does not provide the full calculation or independent confirmation of the FBI attribution.
The report’s headline framing of October as a record month should also be read against the specific measures and periods it gives. The supplied material does not include complete underlying records, independent verification of every figure, or a detailed account of the Binance incident’s method. Those points remain unconfirmed here.
What Security Teams Will Track
The next useful test will be whether the October pattern continues: whether high CVE publication counts are followed by a comparable rise in KEV listings, and whether newly disclosed flaws are exploited before or soon after patches become available. KEV additions and verified incident reporting will provide a more direct view of exploitation than CVE totals alone.
Organizations will also be watching for further technical details about PHP2Shell, the reported early disclosure of its embargoed flaws, and the investigation into the Binance theft and the FBI’s attribution. The supplied source does not state a date for a follow-up report or provide a scheduled next milestone. Until more evidence is published, the role of AI in the month’s wider attack picture remains an assessment rather than a measured conclusion.
Key Questions
What happened in October 2026?
The report counted 17,060 newly published CVE records and $3.47 billion in crypto losses after frozen and returned funds were accounted for. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog during the month.
Does the record CVE count mean attacks quadrupled?
No. The report says October’s CVE count was four times October 2025’s total, but CVEs record disclosed vulnerabilities, not attacks. CISA’s KEV additions rose from 31 to 36 over the same October comparison.
What evidence links AI to the month’s security developments?
The report cites AI-linked vulnerability research, including Microsoft security entries credited to AI models or research firms, and PHP flaws attributed to OpenAI’s Patch the Planet program. These examples do not prove that AI caused the broader rise in disclosures, exploitation or crypto losses.
Who did the FBI blame for the Binance theft?
According to Meyer’s report, the FBI attributed the theft to North Korea’s “TraderTraitor” group on October 31. The supplied material does not include the FBI’s statement or detailed technical evidence for that attribution.
Source: ThorstenMeyerAI.com
