🔍 Read the full analysis: Black October 2026, Episode One: A Cybersecurity Month With AI On Both Sides on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A November 1 analysis of October 2026 reports a record 17,060 new CVE records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. It also cites $3.47 billion in crypto losses, mostly tied to the Binance theft, while arguing that AI is helping both vulnerability discovery and exploit development. The figures measure different things and do not establish that AI caused the month’s records or losses.
A November 1 analysis by Thorsten Meyer reports that October 2026 set a monthly record for published CVE records, while the number of flaws added to the U.S. government’s active-exploitation catalog rose far less sharply. The report also cites $3.47 billion in crypto losses for the month, including a Binance theft the FBI attributed to North Korea, and documents cases where AI tools helped identify software flaws. The figures point to growing security pressure, but they do not show that AI caused the record disclosures or the theft.
Meyer says the National Vulnerability Database published 17,060 new CVE records in October, excluding records marked rejected. That is four times the 4,273 records counted for October 2025. From January through October, the report’s NVD API count was 89,859 records, compared with 39,639 over the same period in 2025. Including rejected records would put October’s total at 17,481, the report says, illustrating how counting choices affect the headline number.
A separate measure shows a more modest increase in flaws with evidence of active exploitation. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. Its 2026 additions had reached 282 by October 30, above the 245 added during all of 2025. The report notes that five October entries were older vulnerabilities, disclosed between 2015 and 2023, for which new evidence of exploitation had emerged.
On AI, the report says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It says the PHP2Shell flaws were found through OpenAI’s Patch the Planet program and patched on October 21. Google’s Big Sleep, meanwhile, reportedly found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These are examples of AI-assisted research, not evidence that AI accounts for the broader rise in CVE records.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Confirmed Exploitation
The central finding is the gap between published flaws and cataloged exploitation. October’s CVE total quadrupled year over year, while CISA’s monthly KEV additions rose from 31 to 36. A published CVE means a vulnerability has been recorded; it does not by itself show that attackers are using it. The report’s comparison is a reminder that disclosure counts are not a direct measure of successful attacks or immediate risk.
For defenders, the rising KEV total still matters: CISA’s catalog is intended to identify flaws for which there is reliable evidence of active exploitation. The October entries touched software and network equipment used as internet-facing access points, including remote-access gateways, firewalls and support tools. Security teams may need to prioritize confirmed exploitation and the systems they actually run rather than treating every newly published CVE as equally urgent.
The crypto figure is a different kind of warning. CertiK’s cited estimate puts October losses at $3.47 billion after frozen and returned funds, against $68 million in October 2025. Meyer says Binance accounted for 96.7% of the month’s total. The report attributes the theft to a compromised laptop, not an AI-discovered software flaw, so the loss does not support a simple claim that AI-driven vulnerability discovery caused the month’s financial damage.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Risks
Meyer separates the month into three measures: disclosed vulnerabilities, documented exploitation and reported crypto losses. Each captures a different part of the security picture. CVE records are public entries describing flaws; CISA’s KEV list tracks vulnerabilities with reliable evidence of active use; crypto-loss estimates tally stolen funds, subject to later freezes and returns. Treating the three as one combined “hack” statistic would obscure what each actually says.
The report cites Google Threat Intelligence Group data published September 30. GTIG counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 across all of 2025. It also estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited, and said zero-day activity rose moderately, from an average of eight to 11 per month. GTIG cautioned that automated assignment practices can inflate CVE totals; its example was roughly 5,000 Linux-kernel-related CVEs from January to August with no observed zero-day exploitation.
These qualifications bear on Meyer’s wider argument that AI is changing both sides of cybersecurity. The report says attackers can use AI to turn public fixes into exploits quickly and that the PHP2Shell disclosure process broke before release. Those claims speak to the speed of exploitation, while the month’s large CVE count alone cannot establish that AI generated the increase.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, describing his thesis
AI’s Role Is Not Measured
The source presents a set of examples and counts, but does not establish how much AI contributed to October’s total vulnerability disclosures, or whether its use caused a measurable change in overall attack rates. The Microsoft release credits and Google Big Sleep result document specific research activity; they do not show that every reported flaw was found by AI or that AI assistance led to exploitation.
Several figures also depend on scope and method. The NVD total changes if rejected records are included, and a KEV addition records newly recognized evidence, not necessarily an attack that began that month. The crypto estimate is reported after funds frozen or returned, and the source says the Binance theft dominated the total. The material does not provide a full breakdown of the remaining losses or independently detail the laptop compromise.
The supplied report is dated November 1, 2026, and cites CISA’s catalog as of October 30. Later catalog updates, revised loss estimates and additional investigation could change the picture. The source also truncates its account of GTIG’s monthly exploitation comparison, so that incomplete figure is not repeated here.
Watch Catalog Updates and Investigations
The immediate next step for readers and security teams is to track new CISA KEV entries and vendor patches, especially for products identified in the October list. The source does not give a future date for a follow-up report or a particular government deadline. Its figures should be read as a snapshot: the NVD counts were queried on November 1, and the cited KEV version was dated October 30.
Further reporting on the Binance theft may clarify the compromise and recovery of funds; the source says the FBI attributed the incident to North Korea’s TraderTraitor on October 31. Updated loss figures could also affect the month’s crypto total. For the AI question, stronger evidence would require sustained comparisons of how flaws are found, patched and exploited—not just a record month of disclosures alongside selected AI-assisted cases.
Key Questions
What record did October 2026 set?
The report counted 17,060 newly published CVE records in the NVD for October, excluding rejected records. It compares that with 4,273 in October 2025 and notes that the total is higher if rejected records are included.
Did exploitation rise as sharply as vulnerability disclosures?
No. CISA added 36 flaws to its KEV catalog in October, up from 31 a year earlier, while the monthly CVE count was four times the October 2025 total. The measures differ: a CVE is a public vulnerability record, while KEV entries have evidence of active exploitation.
What does the report say AI did?
It cites AI-assisted vulnerability research, including Microsoft release credits, OpenAI’s Patch the Planet program and Google’s Big Sleep work on Chrome’s JavaScript engine. These cases show documented use of AI tools, but do not establish AI as the cause of the overall CVE increase.
What was behind October’s crypto losses?
CertiK’s estimate cited in the report puts October losses at $3.47 billion after frozen and returned funds. Meyer says the Binance theft accounted for 96.7% of that figure, and that the FBI attributed the theft to North Korea’s TraderTraitor. The report describes the incident as beginning with a compromised laptop.
Source: ThorstenMeyerAI.com
