🔍 Read the full analysis: Why Black October 2026 Put AI In The Cybersecurity Spotlight on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. The source argues that AI is speeding vulnerability discovery and exploit development, but the figures do not show that AI caused the disclosure surge or the largest theft.
October 2026 set records for published vulnerability disclosures and reported cryptocurrency losses, but the number of flaws added to the U.S. government’s catalog of vulnerabilities known to be exploited rose more slowly. A November 1 analysis by Thorsten Meyer says AI tools helped identify and fix some software flaws, while emphasizing that the available data does not establish AI as the cause of the month’s broader security surge.
The U.S. National Vulnerability Database (NVD) published 17,060 new CVE records in October, according to Meyer’s count using the NVD API and excluding rejected records. That was four times the 4,273 records published in October 2025. From January through October, the count reached 89,859, compared with 39,639 over the same period a year earlier. These figures measure disclosed vulnerability records, not attacks or confirmed exploitable flaws.
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October, up from 31 in October 2025 and 17 in October 2024. The catalog is intended to list vulnerabilities with evidence of exploitation. Its 282 additions during the first 10 months of 2026 had already exceeded the 245 added across all of 2025. The difference between the disclosure and exploitation counts is significant: the number of new CVEs rose much faster than KEV additions.
For cryptocurrency losses, the analysis cites CertiK’s estimate of $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. The source says one Binance incident accounted for 96.7% of the month’s total. On October 31, the FBI attributed that theft to North Korea’s TraderTraitor group. The source reports that the incident began with a compromised laptop, rather than a flaw found by AI.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The figures matter because vulnerability disclosures, confirmed exploitation and financial losses describe different parts of cybersecurity risk. A rise in CVE records can reflect more flaws being found, but also changes in reporting and assignment practices. It does not, on its own, show that attackers are exploiting more software. CISA’s KEV additions offer a narrower measure of vulnerabilities with evidence of real-world use, and they rose by 16% year over year in October, far less than the fourfold increase in new CVE records.
That gap complicates claims that AI has already produced a broad, measurable jump in successful attacks. Meyer cites Google’s threat intelligence group as saying exploitation has risen roughly in step with disclosures and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The same analysis says monthly zero-day counts rose moderately, from an average of eight to 11. Those measures suggest growing activity, but not that most of the additional disclosures became attacks.
For security teams, the practical concern is speed and prioritization. If AI helps researchers find flaws and attackers turn public fixes into working exploits faster, defenders may have less time to patch exposed systems. The month’s data gives reasons to monitor that possibility, but it does not quantify how much AI changed the speed or scale of exploitation. The largest reported financial loss also had a different stated origin, underscoring that AI is one part of a wider threat picture.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Three Different Signals
Meyer separates the month’s numbers into three ledgers: disclosed flaws, flaws listed as exploited, and publicly reported crypto losses. The distinction matters. A CVE is a public record that a vulnerability exists; it is not proof that a criminal used it. KEV entries require evidence of exploitation, while crypto-loss estimates track financial incidents and may change when funds are frozen or returned.
The October CVE count also depends on the counting method. Meyer says the NVD total is 17,060 when rejected records are excluded and 17,481 when they are included. He also cautions that some increases may reflect how vulnerability records are assigned. Google’s threat intelligence group, as cited in the analysis, found that descriptions mentioning the Linux kernel accounted for about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that set. That example shows why publication totals should not be treated as an attack tally.
The analysis also identifies cases in which AI was connected to vulnerability work. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It attributes the PHP2Shell PHP flaws, patched October 21, to OpenAI’s Patch the Planet program. It also reports that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples concern discovery and remediation; they do not establish that AI caused October’s overall CVE record.
“That is my view, not a measurement.”
— Thorsten Meyer, describing his interpretation of the outlook
AI’s Role Is Not Quantified
The data presented does not establish how much AI contributed to the increase in published CVEs, how many attacks used AI, or whether AI shortened the time between disclosure and exploitation across the month. Meyer’s claim that attackers can turn fixes into exploits within days is an interpretation; the source points to PHP2Shell’s embargo breaking before release but does not provide a full measurement of exploit-development times.
There are also limits to the comparisons. NVD totals depend on whether rejected entries are counted, and some CVEs may reflect automated assignment practices rather than newly discovered, independently exploited flaws. CertiK’s loss figure is described after frozen and returned funds, but the source does not provide a transaction-by-transaction breakdown in the supplied material. Details of the Binance incident beyond the FBI attribution and the reported compromised laptop are not established here.
Patch Priorities and Incident Details
Security teams will need to follow updates to CISA’s KEV catalog and prioritize exposed systems tied to newly listed vulnerabilities, rather than treating every CVE as equally urgent. The October examples named in the analysis include remote-access gateways, firewalls, security appliances and widely used software components. Further evidence about exploitation timing would help establish whether AI is changing the window defenders have to respond.
More detail may also emerge about the Binance theft and the basis for the reported losses as investigators and the company provide information. For the broader AI question, the next useful evidence would be consistent, dated reporting on AI-assisted vulnerability discovery, patch releases and confirmed exploitation. Until then, October’s records show a sharp disclosure spike and major financial losses, but they do not by themselves prove that AI drove either trend.
Key Questions
What security records did October 2026 set?
The analysis reports 17,060 new NVD CVE records in October, the highest monthly count in its dataset, and $3.47 billion in crypto losses after frozen and returned funds, based on CertiK figures. CISA added 36 vulnerabilities to its KEV catalog that month.
Does the CVE record mean attacks quadrupled?
No. The fourfold comparison refers to published CVE records in October 2026 versus October 2025. CVEs record disclosed vulnerabilities; they are not a count of attacks. CISA’s KEV additions rose from 31 to 36 over those same months.
What evidence links AI to October’s security activity?
The source cites AI-linked vulnerability research, including Microsoft’s security release credits, OpenAI’s Patch the Planet program and Google’s Big Sleep project. Those examples support a role for AI in finding or fixing some flaws, but do not measure AI’s contribution to the month’s total disclosures or attacks.
Who did the FBI blame for the Binance theft?
The source says the FBI attributed the theft to North Korea’s TraderTraitor group on October 31. It reports that the incident began with a compromised laptop, but the supplied material does not provide further confirmed technical details.
Source: ThorstenMeyerAI.com
