🔍 Read the full analysis: Black October 2026, Episode One: Cyber Threats And AI On Both Sides on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports that October 2026 saw 17,060 new CVE records and $3.47 billion in crypto losses, while CISA added 36 vulnerabilities to its exploited-flaws catalog. It also describes AI-linked vulnerability research and patching, but the figures do not show that AI caused the month’s broader rise in disclosures or attacks.
A November 1 report by Thorsten Meyer says October 2026 set records for vulnerability disclosures and cryptocurrency losses, while the number of flaws newly added to the U.S. government’s exploited-vulnerability catalog rose by less. The figures matter because they distinguish a surge in publicly recorded bugs from evidence that attackers are using them; the report also documents AI-linked security research and patching, without establishing that AI drove the wider increase.
Meyer says the National Vulnerability Database (NVD) published 17,060 new CVE records in October, excluding rejected records, compared with 4,273 in October 2025 and 3,564 in October 2024. His NVD API count for January through October was 89,859 records in 2026, against 39,639 in the same period of 2025. He notes that including rejected records would put October’s total at 17,481, illustrating how counting methods affect the headline figure.
Evidence of exploitation rose less sharply. The Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The report gives 282 additions through October 2026, above the 245 recorded for all of 2025. Five October entries were older flaws, from 2015 to 2023, for which new evidence of exploitation had emerged.
For cryptocurrency losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. The report says Binance represented 96.7% of October’s total and that the FBI attributed a theft from the exchange to North Korea’s TraderTraitor on October 31. It also points to Microsoft’s October security release, where at least 65 entries credited an AI model or AI vulnerability research firm, including one flaw already exploited in the wild. The PHP flaws known as PHP2Shell, patched October 21, came through OpenAI’s Patch the Planet program, according to the report.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Disclosure Outpaced Exploitation
The figures describe different stages of security risk, and combining them can make the month seem more conclusive than it is. CVEs record disclosed vulnerabilities; CISA’s KEV catalog records flaws for which it has reliable evidence of active exploitation. The much larger rise in disclosures does not mean attackers exploited every newly listed flaw. Meyer says the 2026 disclosure count was roughly 2.3 times the January-to-October 2025 total, while the KEV additions rose from 214 to 282 over those same ten months.
That gap matters for defenders deciding where to direct limited patching and investigation resources. A growing catalog of public flaws can increase the work of tracking affected software, but the report’s figures do not establish that all entries carry the same immediate risk. The source cites Google’s threat intelligence group as saying exploitation rose roughly in step with disclosures and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That is a reported estimate, not a guarantee that the remainder are safe.
The AI evidence is also specific rather than sweeping. The report connects AI research to identified flaws and says attackers can use AI to turn fixes into exploits within days, but it does not provide a measured count of attacks caused by AI. The month’s largest reported crypto loss, it says, began with a compromised laptop rather than an AI-discovered software flaw. AI’s role is therefore part of the security picture, not a demonstrated explanation for the records as a whole.
Popular right now
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Risks
Meyer frames the month through three separate measures: disclosed vulnerabilities, confirmed exploitation and reported cryptocurrency losses. A CVE is a public record that a vulnerability exists; it is not, by itself, evidence that attackers have used it. CISA’s KEV catalog is narrower, listing vulnerabilities with reliable evidence of exploitation. Crypto-loss estimates track a different outcome and may change as funds are frozen or returned.
The report says October’s CVE count followed a rise through 2026, with monthly totals passing 12,000 in August and 14,900 in September. It cautions that totals depend on record rules and on how numbering authorities assign CVEs. Citing Google’s threat intelligence group, Meyer says automated assignment policies contributed to high counts, including about 5,000 Linux-kernel-related CVEs from January to August that had no observed zero-day exploitation. The report also says the group counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, above its count of 127 for all of 2025.
Examples in the October KEV additions included flaws affecting remote-access products, security appliances, enterprise software and PHP, according to the report. Google’s Big Sleep project is cited as finding more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples show where research and remediation occurred; they do not establish that AI tools caused the overall CVE increase.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, report author
What the October Totals Cannot Show
The report does not establish that AI caused the rise in CVE disclosures, nor does it quantify how many October attacks used AI. Its examples document AI-linked discovery, research or patching, while the broader claims about attackers using AI are not accompanied here by a complete incident count or a measured comparison with earlier periods.
The exploitation figures are also not a complete inventory of attacks. KEV additions depend on evidence and catalog updates, and some October entries concerned older vulnerabilities. The source’s statement that Binance’s theft began with a compromised laptop is not accompanied in the supplied material by technical details about the intrusion. The amount attributed to October crypto losses may also depend on how frozen and returned funds are treated; the report does not provide a breakdown of the calculation.
The article’s underlying data and comparisons are attributed to Meyer’s NVD query, CISA’s catalog, CertiK and Google’s threat intelligence group. The supplied material does not include full links to each dataset or the FBI statement, so readers cannot independently assess those records from this report alone. Attribution and counting methods remain relevant when comparing the figures with future months.
Further Data Will Test the Pattern
The next useful check is whether later monthly releases sustain the October pattern: a high number of public disclosures, a smaller but rising number of newly cataloged exploited flaws, and continued reporting of AI-supported vulnerability research. Comparisons should use the same date ranges and record rules, including whether rejected CVE records are excluded.
For organizations using affected products, the immediate practical distinction is between a published flaw and one with evidence of active exploitation. Security teams can consult vendor advisories and CISA’s current KEV catalog for updates, while watching for revised information about the cited Binance incident. The supplied report does not name a forthcoming investigation update or a confirmed next publication date for its author’s series.
Key Questions
What record did October 2026 set?
Thorsten Meyer’s NVD API count found 17,060 published CVE records in October, excluding rejected records. He also cites CertiK’s estimate of $3.47 billion in crypto losses after frozen and returned funds.
Did the number of exploited flaws rise as sharply as CVE disclosures?
No. CISA added 36 vulnerabilities to KEV in October 2026, against 31 in October 2025, while the report’s CVE count rose from 4,273 to 17,060. The measures track different things and are not directly interchangeable.
Does the report show that AI caused the October records?
No. It cites AI-linked vulnerability research and patching, including work connected to PHP2Shell, but does not demonstrate that AI caused the overall increase in disclosures, exploitation or crypto losses.
What did the FBI attribute to North Korea?
The report says the FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31. The supplied material does not include the FBI’s full statement or detailed evidence about how the theft occurred.
Source: ThorstenMeyerAI.com
