🔍 Read the full analysis: Could AI Shape Cybersecurity’s Fight? Lessons From Black October 2026 on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. The figures show a widening gap between disclosed flaws and those known to be exploited; the source also documents AI-assisted vulnerability research and argues that AI may help attackers turn fixes into exploits faster. It does not establish that AI caused October’s overall surge or the Binance theft.
An analysis published November 1 found that October 2026 set records for published vulnerability disclosures and reported crypto losses, while evidence of active exploitation grew more slowly. The figures highlight a difficult question for defenders: whether AI-assisted research is accelerating the discovery and repair of flaws, and whether attackers can use AI to exploit them faster.
Thorsten Meyer’s analysis says the U.S. National Vulnerability Database recorded 17,060 new CVE entries in October, excluding rejected records, compared with 4,273 in October 2025. From January through October, it counted 89,859 entries, against 39,639 in the same period a year earlier. These are published vulnerability records, not a count of successful attacks or proof that every listed flaw is exploitable.
The exploitation figures rose by less. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025. The catalog had 282 additions in 2026 through October 30, more than the 245 recorded for all of 2025. CISA’s list identifies vulnerabilities for which there is evidence of exploitation, a narrower measure than the number of published CVEs.
The analysis also cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds were accounted for, compared with $68 million in October 2025. It says Binance accounted for 96.7% of the October total. The FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31, according to Meyer’s account. Those loss figures do not establish that AI was involved in the theft.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Disclosure Outpaced Exploitation
The contrast between 17,060 monthly CVE entries and 36 additions to CISA’s exploited-vulnerability catalog matters for how organizations interpret security headlines. A disclosure count can rise because more flaws are found, reporting practices change, or automated processes assign records at greater scale. It does not mean attackers are exploiting every newly listed flaw. The source cites Google Threat Intelligence Group’s warning that automated assignment policies can inflate totals, including thousands of Linux-kernel CVEs from January to August that it said had no observed zero-day exploitation.
For security teams, the practical issue is prioritization. A rapidly expanding list can make it harder to identify the flaws that pose immediate risk, while confirmed exploitation still calls for timely patching and attention to exposed systems. The analysis says October’s KEV additions included remote-access products, firewalls, collaboration software, virtualization tools, PHP and Google’s Brotli library. The list suggests a range of technologies may require review, but the presence of a product on it does not by itself show that a particular organization was compromised.
AI’s potential effect is less settled than the monthly totals. Meyer argues that attackers can use AI to turn public fixes into working exploits within days, while also citing AI-assisted vulnerability discovery and repair. If that timing claim holds across more cases, defenders may have less time between a patch becoming public and attacks appearing. The material documents examples, but does not quantify how often AI was used by attackers or show that it caused October’s record disclosures.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
Three Measures Behind October’s Records
The analysis separates October’s figures into three measures: disclosed flaws, known exploitation and reported theft. They track different events. CVEs are public records that a vulnerability exists; CISA’s KEV catalog records vulnerabilities with reliable evidence of active exploitation; crypto-loss estimates track funds stolen, frozen or returned. Treating these ledgers as interchangeable would overstate what the data shows.
Meyer says his NVD count came from an API query on November 1, grouped by publication date and excluding rejected records. He notes that including rejected records would bring October’s figure to 17,481. The year-to-date counts and comparisons therefore depend on the stated counting method. Separately, he cites Google Threat Intelligence Group’s assessment that exploitation rose broadly alongside disclosure, and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. He also reports an average of 8 to 11 zero-days a month, a moderate increase rather than a comparable jump to CVE disclosures.
The article identifies AI-linked vulnerability research in two examples. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It also says PHP flaws known as PHP2Shell were patched on October 21 after emerging from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show AI’s role in research and remediation; they do not measure AI’s contribution to the month’s overall CVE total.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, describing his thesis
What October’s Data Cannot Show
The figures do not establish that AI caused the CVE record, the increase in known exploitation or the crypto losses. The source’s claim that attackers can convert fixes into exploits within days is an interpretation supported by examples, not a measured rate covering all vulnerabilities. It also says PHP2Shell’s embargo broke before release, but the supplied material does not detail the breach or establish how AI contributed to it.
The reported crypto total depends on CertiK’s accounting after frozen and returned funds. The source says the FBI attributed the Binance theft to North Korea’s TraderTraitor, but provides no FBI statement or technical findings beyond that attribution. It says the theft began with a compromised laptop rather than an AI-found bug; the supplied material does not identify the laptop’s user, explain the compromise or provide a complete attack timeline.
It is also unclear how much of the CVE increase reflects newly discovered flaws versus changes in disclosure and assignment practices. The analysis notes that automated policies can raise counts and that counting rejected records changes the October total. More information about these methods, and comparable data over subsequent months, would be needed to judge whether October marks a lasting change in risk.
Tracking Patches and Exploits
The immediate next step for defenders is to check CISA’s October 30 KEV catalog and determine whether affected products are present in their own environments, then follow vendor guidance on patching and mitigation. The growing CVE count may be useful for monitoring disclosure activity, but the analysis argues that evidence of exploitation and the exposure of specific systems should guide urgent response.
For the broader AI question, the evidence will need continued tracking: whether AI-assisted findings are credited in future security releases, how quickly public flaws are exploited after fixes appear, and whether independently documented cases show AI playing a direct role in attacks. The November analysis offers October as an early test of Meyer’s thesis, while leaving its longer-term scale and consequences open.
Key Questions
What set records in October 2026?
The analysis counted 17,060 published CVE records in the NVD for October, excluding rejected entries, and estimated $3.47 billion in crypto losses after frozen and returned funds. These measures describe disclosures and reported losses, not one combined measure of cyberattacks.
Did exploitation increase as sharply as CVE disclosures?
No. CISA added 36 vulnerabilities to its KEV catalog in October, up from 31 in October 2025, while the NVD disclosure count rose from 4,273 to 17,060. The two catalogs measure different things, and the source says the exploitation increase was much smaller.
Did AI cause the October records or the Binance theft?
The supplied material does not establish either claim. It reports examples of AI-assisted vulnerability research and patching, but does not show that AI caused the record disclosure count or the Binance theft.
What should organizations take from the figures?
Organizations should distinguish a published vulnerability from one known to be exploited, check whether affected products are in use, and follow vendor and CISA guidance. The figures alone do not show that a particular organization was attacked.
Source: ThorstenMeyerAI.com
