🔍 Read the full analysis: Black October 2026, Episode One: The Cybersecurity Story Behind AI On Both Sides on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A November 1 report by Thorsten Meyer says October 2026 set a monthly record with 17,060 published CVE records, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. It also cites $3.47 billion in crypto losses, mostly tied to a Binance theft the FBI attributed to North Korea; the report says AI contributed to finding some flaws, but the available figures do not show that most newly disclosed vulnerabilities were exploited.
A report published November 1 says October 2026 set a record for public vulnerability disclosures, while documented additions to the U.S. government’s exploited-flaw list rose much less sharply. The report also records $3.47 billion in crypto losses for the month and cites cases in which AI tools helped identify software flaws, raising questions about how quickly defenders and attackers can act on new information.
Author Thorsten Meyer says his count of National Vulnerability Database records found 17,060 new CVEs published in October, compared with 4,273 in October 2025. For January through October, his count was 89,859, against 39,639 over the same months of 2025. The figures are based on a query of the NVD API, counting publication dates and excluding rejected records; including rejected records would put October’s total at 17,481, the report says.
The exploitation figures were smaller. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog listed 282 additions for 2026 through October 30, already above the 245 added during all of 2025. These are catalog additions, not a count of every attack or every flaw exploited that month.
The report says CertiK counted $3.47 billion in October crypto losses after accounting for frozen and returned funds, compared with $68 million in October 2025. It attributes 96.7% of the October total to the Binance incident. The FBI attributed the theft to North Korea’s “TraderTraitor” on October 31, according to the report. Meyer also says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Records Outpaced Exploitation
The figures describe different parts of the security picture. A CVE disclosure records that a vulnerability is public; it does not establish that attackers used it. CISA’s KEV catalog is a narrower measure based on evidence of active exploitation. In October, disclosure volume rose far faster than KEV additions, a distinction that matters when organizations prioritize patching amid a surge of public records.
The report cites Google Threat Intelligence Group’s estimate that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That ratio and the monthly totals do not prove that the disclosure surge is harmless: a smaller number of exploited flaws can still affect widely used systems. The report names remote-access gateways, firewalls, support tools and software platforms among October’s KEV additions, underscoring the range of products defenders may need to review.
AI’s role is also more specific than the title’s “both sides” framing might suggest. The report describes AI-assisted vulnerability discovery and says attackers can use AI to turn fixes into exploits quickly, but it does not quantify how many October attacks were AI-enabled. Its evidence supports a concern about the speed of the cycle, not a conclusion that AI caused the month’s overall records or crypto losses.
Popular right now
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
De'Longhi 15-Bar Pump Espresso Machine with Milk Frother & Temperature Control
Ninja DualZone Smart XL Air Fryer, 10-Qt, 6-in-1, DZ950
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer organizes October’s figures into three ledgers: disclosed flaws, documented exploitation and reported crypto theft. They measure different events and should not be combined into a single “hack count.” CVE totals can also vary with counting choices: the report excludes rejected records and counts by publication date. It cautions that assigned CVE numbers are not themselves a measure of published vulnerabilities.
The report says Google’s threat intelligence group found that exploitation had risen roughly in step with disclosure in its broader tracking, and counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. It also reports an average of 8 to 11 zero-days per month, describing that change as moderate. Separately, Meyer says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months; the source does not provide the underlying count in the supplied material.
For the PHP flaws known as PHP2Shell, the report says OpenAI’s Patch the Planet program contributed to finding them and that patches were issued on October 21. It says the disclosure embargo broke before release. The source presents this as an example of AI-supported discovery and a rapid disclosure-to-exploitation risk, not as proof that the flaws were exploited in attacks.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, report author
The report does not establish how many October attacks involved AI, whether AI caused the CVE record increase, or how many newly disclosed vulnerabilities will later be exploited. It also does not provide enough detail to independently assess the methods behind every reported total. NVD counts depend on inclusion rules, and the KEV catalog reflects additions backed by evidence rather than a complete census of exploitation.
The source says the FBI attributed the Binance theft to North Korea’s TraderTraitor, but the supplied material does not describe the incident’s technical entry point or establish an AI connection. Meyer says the largest theft of the month began with a compromised laptop rather than an AI-found bug. The report gives no further evidence about that laptop or the incident’s full sequence, so those details remain unclear here.
Nor does the supplied material specify the full set of AI-credited Microsoft entries, the models involved, or how attribution to an AI tool was determined in each case. The claim that attackers can use AI to turn fixes into exploits within days is presented as the author’s assessment; the material does not quantify the number of such incidents.
Track Patches and Exploitation Evidence
The immediate next indicators are updated NVD records, new additions to CISA’s KEV catalog, and disclosures about the October incidents. These can show whether the gap between published vulnerabilities and documented exploitation changes as more evidence emerges. Organizations should use product-specific advisories and CISA’s catalog to identify flaws known to be exploited, rather than treating every CVE as an equivalent active threat.
Further reporting would be needed to establish AI’s contribution on either side: which vulnerabilities were found with AI assistance, whether attackers used AI in specific incidents, and how quickly a disclosed flaw was weaponized. The Binance attribution and loss estimates may also be clarified by subsequent statements from investigators and the affected parties. Until then, the report’s central finding is a record disclosure month alongside a far smaller rise in documented exploitation, with AI’s overall effect still unmeasured.
Key Questions
How many CVEs were published in October 2026?
Thorsten Meyer’s query of the NVD API counted 17,060 records, excluding rejected entries. The report says the total would be 17,481 if rejected records were included.
Did exploited vulnerabilities rise as quickly as disclosures?
No, not in the report’s October comparison. CISA added 36 KEV entries, up from 31 a year earlier, while the NVD CVE count rose from 4,273 to 17,060. The measures have different definitions and should not be read as direct equivalents.
Was the Binance theft linked to AI?
The supplied report does not link the theft to AI. It says the FBI attributed it to North Korea’s TraderTraitor and describes a compromised laptop as the starting point, without providing further technical details.
What evidence does the report give for AI finding vulnerabilities?
It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, and that OpenAI’s Patch the Planet program found the PHP2Shell flaws. The report does not quantify AI’s contribution across all disclosed flaws or attacks.
Source: ThorstenMeyerAI.com
