🔍 Read the full analysis: A Look At AI’s Role In Black October 2026’S Cybersecurity Events on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record number of published CVEs and a record crypto theft, while CISA’s exploited-vulnerability additions rose much less sharply. The source reports that AI tools helped identify some flaws and speed exploit development, but says the data do not establish that AI caused the month’s overall increase in attacks or losses.
October 2026 set records for published vulnerabilities and reported cryptocurrency losses, while the number of flaws added to the U.S. government’s active-exploitation catalog rose more modestly, according to a November 1 analysis by Thorsten Meyer. The figures point to a month in which AI contributed to finding some security bugs, but they do not show that AI drove the broader rise in disclosures or the largest reported theft.
Meyer’s count of the National Vulnerability Database (NVD), based on records published by month and excluding rejected entries, found 17,060 new CVE records in October. That was four times the 4,273 recorded in October 2025. From January through October, the count reached 89,859, compared with 39,639 over the same period a year earlier. The figures are the author’s query of the NVD API, not a measure of how many flaws attackers used.
A separate measure showed a smaller increase in documented exploitation. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, versus 31 in October 2025. Its 282 additions from January through October already exceeded the 245 added during all of 2025. The catalog records vulnerabilities for which CISA reports evidence of exploitation; it is not a count of every cyberattack.
The report also cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds, compared with $68 million in October 2025. It says one Binance incident accounted for 96.7% of October’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. Those are attributed figures and findings; the source does not establish that the theft involved an AI-discovered vulnerability.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Records Do Not Equal Exploits
The gap between disclosures and confirmed exploitation is central to interpreting the month. More published CVEs can reflect more flaws being found or recorded, not necessarily more successful attacks. Meyer’s figures show the October CVE count quadrupling year over year while CISA’s monthly additions rose from 31 to 36. The comparison suggests that disclosure volume and observed exploitation are moving at different rates.
That distinction matters to organizations setting priorities. Treating every newly published record as an active emergency could overwhelm security teams; treating a smaller exploitation count as proof of low risk would also be misleading. CISA’s catalog and vendor advisories can help identify vulnerabilities with evidence of real-world use, but the report does not provide a complete census of attacks or exposures.
AI adds a further operational concern. If attackers use models to turn public technical details or patches into working exploits more quickly, defenders may have less time to update exposed systems. Meyer says the evidence supports concern about speed in some cases, but not a broad claim that AI caused October’s records or the crypto losses.
Popular right now
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Shark Clean & Empty Cordless Stick Vacuum with Auto-Empty System, BU3521
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Questions
The report separates three sets of numbers: disclosed vulnerabilities, vulnerabilities with evidence of exploitation, and cryptocurrency losses. They track different events and cannot be combined into a single measure of how dangerous a month was. CVE records are public identifiers and descriptions; CISA’s KEV catalog is a narrower list of flaws considered exploited; crypto-loss estimates track reported financial losses in that sector.
Counts also depend on method. Meyer says the October NVD total would be 17,481 if rejected records were included, rather than 17,060. The report cites Google’s threat intelligence group as warning that automated assignment practices can inflate CVE totals. It says descriptions mentioning the Linux kernel generated about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation in that set. That example cautions against treating a record count as a direct measure of attacker activity.
On AI-related findings, the report says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It also says PHP2Shell vulnerabilities patched October 21 came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples document contributions to discovery; they do not establish that AI found every flaw disclosed that month.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 report
What the Figures Cannot Establish
The report’s measurements do not establish that AI caused the rise in CVE publications, the increase in KEV additions, or October’s crypto losses. The relationship between AI-assisted discovery and real-world attacks remains case-specific; the report provides examples, but not a complete count of flaws found or exploited with AI assistance.
The source says attackers used AI to turn fixes into exploits within days and that the PHP2Shell embargo broke before release, but it does not provide enough detail here to independently assess the timing or establish a general rate. It also says the Binance theft began with a compromised laptop rather than an AI-found bug. The report does not supply a full incident account or explain the evidence behind that entry point.
There are limits to the headline figures as well. NVD totals vary according to whether rejected records are counted, and CVE assignment practices affect the overall volume. The source does not explain the full methodology behind CertiK’s loss estimate or provide a detailed breakdown of the Binance incident. These limits mean the numbers should be read as attributed indicators, not a complete accounting of October’s cyber activity.
Tracking Exploitation and Patches
The next useful test is whether the high disclosure pace continues and whether a larger share of newly published flaws appears in CISA’s KEV catalog or other documented incident reporting. Monthly CVE totals alone will not answer that question; tracking exploitation evidence, patch availability and the time between disclosure and attack will offer a clearer view of risk.
For defenders, the immediate practical step is to review vendor advisories and prioritize exposed systems affected by vulnerabilities with evidence of exploitation, including those identified in CISA’s catalog. The report points to remote-access gateways, firewalls, support tools, software platforms and widely used libraries among October’s additions. It does not provide a single remediation deadline or a complete list of affected products in the supplied material.
Further reporting on the Binance incident and the AI-linked vulnerability cases may clarify how the flaws were found, when attackers gained access, and whether AI changed the time available for response. Until then, the strongest supported conclusion is narrower: October had exceptional disclosure and loss figures, documented AI contributions to some security research, and a more limited rise in cataloged exploitation.
Key Questions
What cybersecurity records were reported for October 2026?
The report counted 17,060 new NVD CVE records and cited $3.47 billion in October cryptocurrency losses after frozen and returned funds. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog.
Does the CVE record show that a vulnerability was exploited?
No. A CVE is a public vulnerability record. CISA’s KEV catalog is a separate list of vulnerabilities for which the agency reports evidence of active exploitation.
What role did AI play in the reported security events?
The report says AI models or AI vulnerability research firms were credited in at least 65 entries in Microsoft’s October security release. It also cites findings by OpenAI’s Patch the Planet program and Google’s Big Sleep, but does not show that AI caused the overall rise in disclosures or the Binance theft.
How many vulnerabilities did CISA add in October?
CISA added 36 vulnerabilities to its KEV catalog in October 2026, compared with 31 in October 2025. The catalog additions are not a count of all cyberattacks.
What remains uncertain about the Binance theft?
The report says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31 and says the incident began with a compromised laptop. The supplied material does not provide a full account of the intrusion or establish a role for AI.
Source: ThorstenMeyerAI.com
