🔍 Read the full analysis: What The Black October 2026 Cybersecurity Story Says About AI on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A November 1 analysis of October 2026 reports record CVE disclosures, a smaller rise in vulnerabilities added to CISA’s exploited-flaw catalog, and $3.47 billion in crypto losses. The source documents AI-assisted vulnerability research and rapid exploit development, but its figures do not establish that AI caused the disclosure surge or the month’s largest theft.
October 2026 set records for public vulnerability disclosures and reported crypto losses, but a review published Nov. 1 by Thorsten Meyer says the figures offer mixed evidence about AI’s role in cyber risk. The analysis counted 17,060 new CVE records in the National Vulnerability Database and $3.47 billion in crypto losses after frozen and returned funds were deducted, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. Those measures track different things and do not show that AI caused either record.
Meyer’s NVD API count, which excludes rejected records and sorts by publication date, found 17,060 CVEs in October, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count was 89,859, against 39,639 for the same period in 2025. The article cautions that including rejected records changes October’s total to 17,481, and that CVE totals can be affected by how numbering authorities assign records.
The exploitation figures rose more slowly. CISA added 36 flaws to its KEV catalog in October, compared with 31 in October 2025 and 17 in 2024. Its January-to-October additions reached 282, exceeding the 245 added during all of 2025. KEV entries are flaws for which CISA has evidence of exploitation; they are not a count of every attack. The source also cites Google’s threat intelligence group, which said exploitation had risen roughly in step with disclosures over a longer period and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited.
On AI, the article says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It identifies PHP2Shell, patched Oct. 21, as emerging from OpenAI’s Patch the Planet program, and says Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. These examples document AI-related research and fixes; they do not establish that AI produced the month’s overall CVE increase.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
What the Records Measure
The records matter because disclosure, exploitation and financial theft are separate indicators. A large CVE count can mean more flaws are being reported or assigned records, but it does not show that attackers used all of them. CISA’s KEV list is a narrower signal of flaws with evidence of active exploitation, while crypto-loss estimates track reported financial consequences in a particular sector.
That distinction changes how readers should interpret October’s headline figures. Disclosures were far above the previous October, but KEV additions rose from 31 to 36 year over year. Meyer calculates that October KEV additions were about 0.2% of new CVEs in 2026, compared with about 0.5% in 2024; this is a comparison of two catalog counts, not a measure of the probability that any individual flaw will be exploited.
The practical AI question is less whether a monthly record proves a new era than whether AI changes the time and effort required to find, fix or weaponize flaws. The source argues that attackers can use AI to turn fixes into exploits within days and says an embargo on PHP2Shell broke before its release. That is an interpretation of the cases presented, not a comprehensive measurement of AI’s contribution to attacks. For defenders, the evidence supports attention to patch timing and known-exploited flaws, while leaving the scale of AI’s effect unsettled.
Products Worth Considering
DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black
Amazon Kindle Scribe Colorsoft, 64GB, 11-Inch Color Display with Premium Pen
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Different October Ledgers
Meyer’s analysis separates the month into three “ledgers”: publicly disclosed CVEs, vulnerabilities listed as exploited, and crypto losses. The NVD figures are the author’s query of a public database as of the morning of Nov. 1, with rejected records excluded. Because counting rules and automated assignment practices can shape totals, the article warns against treating every CVE as a newly discovered, equally serious bug.
For the exploitation ledger, the analysis uses CISA’s KEV catalog version dated Oct. 30. Five of October’s 36 additions were older vulnerabilities, dated from 2015 to 2023, for which new evidence of exploitation had emerged. The source also cites Google’s threat intelligence group’s Sept. 30 account: it counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 in all of 2025. The figures use a different time window from October’s monthly comparison.
For the financial ledger, the article attributes $3.47 billion in October crypto losses, after frozen and returned funds, to CertiK. It says Binance accounted for 96.7% of that month’s figure. The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on Oct. 31, according to the source. The article says the incident began with a compromised laptop rather than an AI-found software flaw, underscoring that the month’s largest loss does not itself demonstrate AI-driven vulnerability exploitation.
What October Cannot Establish
The figures do not establish that AI caused the CVE surge, drove the reported crypto losses or accounts for a particular share of exploitation. The source is an individual analysis, and its CVE totals depend on query date and counting rules. The difference between 17,060 records excluding rejected entries and 17,481 including them illustrates that methodological choices affect the result.
It is also unclear from the material how many of the 65 Microsoft release entries involved AI in the discovery process, how the credits were assigned, or whether the same AI tools materially changed the time or success rate of exploitation. The account gives selected examples rather than a complete audit of AI use across security research and attacks. The source reports that the PHP2Shell embargo broke before release, but does not provide enough detail here to quantify the breach’s scope or its consequences.
The crypto-loss total is attributed to CertiK, and the article reports the FBI’s attribution of the Binance theft to North Korea’s TraderTraitor. The supplied material does not include the underlying investigation or a detailed account of how the compromised laptop led to the theft. Those points should be treated as attributed reporting, not independent findings established by the CVE and KEV counts.
Evidence to Watch After October
The next useful comparison is whether subsequent months show a sustained rise in observed exploitation, not just a high count of published CVEs. Future updates to CISA’s KEV catalog and longer-run threat-intelligence reporting may help clarify whether the gap between disclosure and exploitation is changing. Those measures still will not, on their own, identify which attacks used AI.
For AI’s role, stronger evidence would require documented cases linking specific tools to flaw discovery, patch development or attacks, alongside clear dates and methods. The October examples provide a starting point, but the analysis does not set out a systematic comparison with non-AI research or exploitation. Its central claim about the pace of AI-assisted attacks therefore remains a thesis to test against further cases.
The immediate record is narrower: October saw unusually high disclosure and reported crypto-loss totals, more KEV additions than in the same month last year, and named cases of AI-linked security research. Whether those developments mark a durable change in cyber risk will depend on what later data show about exploitation, attribution and the time between fixes and attacks.
Key Questions
What cybersecurity records did October 2026 set?
Thorsten Meyer’s analysis counted 17,060 new NVD CVE records in October, excluding rejected records, and cited $3.47 billion in crypto losses after frozen and returned funds. CISA added 36 vulnerabilities to its KEV catalog that month. These are separate measures, not one combined count of attacks.
Does the CVE record mean attackers exploited more flaws?
No. A CVE record marks a publicly recorded vulnerability; it does not establish exploitation. CISA’s KEV catalog lists vulnerabilities with evidence of active exploitation. In October, its additions rose to 36 from 31 a year earlier, far less than the increase in new CVE records reported by the analysis.
What evidence links AI to October’s security work?
The analysis says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm. It also cites OpenAI’s Patch the Planet program in connection with PHP2Shell and Google’s report about its Big Sleep research system. These examples show AI-linked research activity but do not quantify AI’s overall effect on vulnerabilities or attacks.
Was the Binance theft caused by an AI-found vulnerability?
The supplied analysis says the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on Oct. 31 and says the incident began with a compromised laptop, not an AI-found bug. It does not provide a detailed account of the theft’s mechanics, so the source does not support a broader conclusion about AI’s role in the incident.
Source: ThorstenMeyerAI.com
