🔍 Read the full analysis: Black October 2026: How AI Fits Into A Month Of Record CVEs And Crypto Crime on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source reports that October 2026 set a monthly record with 17,060 published CVE records, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. CertiK counted $3.47 billion in crypto losses, most linked to a Binance theft the FBI attributed to North Korea; documented AI work found and helped fix flaws, but the figures do not show that AI caused the broader rise in attacks.
An analysis published November 1 says October 2026 set a record for monthly CVE disclosures, with 17,060 records published in the U.S. National Vulnerability Database, while crypto losses reached a reported $3.47 billion. The figures show a sharp gap between disclosed flaws and vulnerabilities added to the U.S. government’s list of those known to be exploited: CISA added 36 in October, up from 31 a year earlier. The report also documents AI-related vulnerability research and fixes, but does not establish that AI drove the wider increase in disclosures or thefts.
The figures come from an analysis by Thorsten Meyer, who says he queried the NVD API on November 1, counted records by publication date and excluded rejected records. On that basis, October’s total was four times the 4,273 records in October 2025 and above the 3,564 counted for October 2024. From January through October, the analysis counted 89,859 records in 2026, compared with 39,639 in the same period of 2025. Including rejected records raises October 2026’s count to 17,481, the source says.
CISA’s Known Exploited Vulnerabilities catalog, a separate measure focused on flaws with evidence of active exploitation, gained 36 entries in October, compared with 31 in October 2025 and 17 in October 2024. The source counts 282 additions for January through October 2026, already above the 245 added during all of 2025. Five of October’s additions concerned older vulnerabilities, dating from 2015 to 2023, for which new evidence of exploitation was reported.
For crypto losses, the analysis cites CertiK’s October estimate of $3.47 billion after frozen and returned funds, compared with $68 million in October 2025. It says Binance accounted for 96.7% of the October total. The FBI attributed the Binance theft to North Korea’s TraderTraitor group on October 31. These are separate ledgers: CVE publications measure disclosed records, CISA additions track known exploitation, and crypto-loss estimates measure reported financial losses.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The month’s figures matter because a record number of disclosed flaws does not mean a matching surge in attacks. CISA’s additions rose from 31 to 36 year over year, while the NVD record count rose from 4,273 to 17,060. The measures use different methods and should not be treated as directly equivalent rates, but their contrast cautions against reading every new CVE as an actively exploited threat.
The source cites Google’s Threat Intelligence Group (GTIG), which said exploitation had risen roughly in step with disclosure over its broader tracking period, and estimated that about one in 431 vulnerabilities disclosed in 2026 had been seen exploited. GTIG also reported that automated assignment policies can inflate CVE totals: it counted about 5,000 Linux-kernel-related CVEs from January to August 2026 with zero observed zero-day exploitation. That observation does not mean those flaws pose no risk; it shows why disclosure counts alone are a limited guide to immediate exposure.
For organizations, the practical distinction is between the volume of records and the evidence that attackers are using a flaw. The reported October entries include software and services that can sit at network boundaries or support remote access, among them Ivanti and Citrix gateways, security appliances, collaboration tools and PHP. The source’s figures support prioritizing verified exploitation and affected systems, rather than treating the CVE record as a measure of attack impact by itself.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
The report frames October through three measures: disclosed vulnerabilities, vulnerabilities listed as exploited, and reported crypto theft. A CVE is a public record that a vulnerability exists; its publication does not by itself show that an attacker has used it. CISA’s KEV catalog is narrower, listing vulnerabilities for which the agency cites reliable evidence of exploitation. Crypto loss estimates track a different outcome and do not establish that a particular software vulnerability was involved.
On AI, the source says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw described as already exploited in the wild. It says PHP2Shell, PHP flaws patched October 21, came from OpenAI’s Patch the Planet program. Google’s Big Sleep, the source reports, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples document AI’s role in vulnerability research and remediation; they do not show that AI caused October’s CVE record or the Binance theft.
The author argues that attackers can use AI to turn fixes into exploits quickly and says the PHP2Shell disclosure embargo broke before release. Those points are presented as the author’s interpretation of events, not as a measured explanation for the month’s totals. The report itself also says the largest crypto theft of the month began with a compromised laptop, rather than an AI-found bug.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, source author
AI’s Role Is Not Yet Measured
The source’s data do not establish that AI caused the CVE surge, the increase in KEV additions or the crypto losses. The AI-related examples concern research, bug discovery and patching; the article offers no comparable count of attacks enabled by AI. Meyer’s claim that attackers can use AI to turn fixes into exploits within days is an interpretation, and the source does not quantify how often that happened in October.
Some figures also depend on definitions and collection methods. The CVE total excludes rejected records, while a count that includes them is higher. A CVE’s publication is not proof of exploitation, and CISA catalog additions may include older flaws for which evidence emerged later. CertiK’s loss estimate is reported after frozen and returned funds, but the supplied material does not detail the underlying calculation or give a transaction-by-transaction account. The FBI attribution of the Binance theft is an official attribution, not an independently demonstrated finding in the source material.
The article’s headline describes a record month, but its supplied figures do not fully document every worldwide vulnerability database or every crypto incident. The record claims should therefore be read as claims based on the stated NVD, CISA and CertiK measures. The source does not provide enough information to independently verify all comparisons or explain the full cause of the increase in NVD publications.
Track Exploitation and Attribution
The next useful checkpoints are updates to CISA’s KEV catalog, subsequent reporting on the Binance theft and further technical information about the vulnerabilities cited in the October releases. Those developments could clarify how many disclosed flaws receive evidence of exploitation and whether investigators publish additional details about the theft’s method and attribution.
Organizations should follow vendor advisories and official catalog updates for systems they use, while distinguishing a disclosed CVE from a confirmed exploited vulnerability. The source offers no forecast or confirmed timetable for further AI-related findings. Whether AI is materially speeding up either discovery or exploitation remains a developing question, and future evidence will need to separate AI’s documented role in finding and fixing bugs from claims about its use by attackers.
Key Questions
How many CVE records were published in October 2026?
The source’s count of 17,060 records is based on the NVD API, publication date and exclusion of rejected records. Including rejected records, the source gives a total of 17,481.
Did CISA report four times as many exploited vulnerabilities?
No. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October 2026, compared with 31 in October 2025. The fourfold comparison applies to the source’s NVD disclosure counts, not CISA’s additions.
What was the reported crypto loss in October?
The source cites a CertiK estimate of $3.47 billion in October losses after frozen and returned funds. It says Binance accounted for 96.7% of that total and that the FBI attributed the Binance theft to North Korea’s TraderTraitor group.
Does the report show that AI caused the October records or theft?
No. It documents AI-related vulnerability research and patching, including the source’s accounts of Microsoft release credits, PHP2Shell and Google’s Big Sleep. It does not establish that AI caused the overall CVE increase or the Binance theft.
Source: ThorstenMeyerAI.com
