🔍 Read the full analysis: Did AI Change The Fight In Black October 2026? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, while CISA added 36 flaws to its Known Exploited Vulnerabilities catalog. The figures show AI-assisted vulnerability research and rapid exploit development, but they do not establish that AI caused the month’s records or the Binance theft. The source’s evidence suggests disclosure surged much faster than observed exploitation.
October 2026 set records for published vulnerability disclosures and reported crypto losses, while evidence about AI’s role in attacks remained mixed, according to data compiled by Thorsten Meyer. The month included 17,060 new CVE records in the U.S. National Vulnerability Database and a $6 billion-plus theft from Binance, but the figures do not show that AI caused either record.
Meyer’s count of NVD records, queried on November 1 and excluding rejected entries, puts October’s total at 17,060, compared with 4,273 in October 2025 and 3,564 in October 2024. For January through October, the count was 89,859 in 2026, against 39,639 in 2025. These are published vulnerability records, not a count of attacks or proof that every listed flaw was exploited.
The exploitation data rose less sharply. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog had 282 additions through October 2026, exceeding its full-year 2025 total of 245. The source notes that five October additions involved older flaws, with newly reported evidence of exploitation.
Crypto-loss figures offer a separate measure. The source attributes to CertiK an estimate of $3.47 billion in October losses, after frozen and returned funds were accounted for, compared with $68 million in October 2025. It says the Binance incident represented 96.7% of that month’s total. On October 31, the FBI attributed the Binance theft to North Korea’s TraderTraitor. The source describes the amount leaving Binance on October 29 as more than $6 billion; the loss estimate and amount moved are distinct measures.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Surged Faster Than Exploitation
The gap between disclosures and confirmed exploitation is central to judging whether October marked a change in cyberattacks. The source’s figures show the CVE count more than quadrupled year over year for October, while CISA’s monthly additions rose from 31 to 36. That suggests the disclosure surge cannot be treated as an equivalent rise in attacks. A CVE record documents a known flaw; CISA’s catalog is a narrower list of vulnerabilities with evidence of active exploitation.
That distinction matters to organizations prioritizing security work. A rapidly expanding list can make it harder to identify which flaws need immediate attention, while exploitation evidence offers a more focused signal. Google’s threat intelligence group, as summarized by Meyer, estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The source also says zero-day exploitation rose moderately, from an average of eight to 11 per month. Those figures point to rising activity, but not an attack wave equal in size to the CVE increase.
There is evidence that AI may change how quickly some vulnerabilities are found, fixed or exploited. Meyer reports that at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including one flaw already exploited in the wild. The PHP2Shell flaws, patched October 21, came from OpenAI’s Patch the Planet program. These examples show AI’s involvement in security work; they do not establish that AI was responsible for the month’s overall records.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Questions
Meyer frames the month through three separate measures: disclosed, exploited and stolen. CVE totals track public vulnerability records. CISA’s KEV catalog records flaws for which there is reliable evidence of active exploitation. Crypto-loss estimates track reported losses in a different domain. Combining them into one “record for hacks” would blur what each number can and cannot show.
The CVE count also depends on counting rules. Meyer queried the NVD API by publication date and excluded rejected records; including those records would put October at 17,481, according to his account. He also cites Google’s threat intelligence group warning that automated assignment practices can inflate totals. The group reportedly found around 5,000 CVEs mentioning the Linux kernel from January through August 2026, with no observed zero-day exploitation of those flaws.
On the AI side, Meyer says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. He also argues that attackers can use AI to turn fixes into exploits within days, and says the PHP2Shell embargo broke before release. These are examples and interpretations reported in the source, not proof that AI drove October’s overall attack volume. The same account says the Binance theft began with a compromised laptop, rather than an AI-discovered vulnerability.
What October’s Numbers Cannot Prove
The figures do not establish that AI caused the CVE record, the increase in KEV additions or the Binance theft. The source provides examples of AI-assisted research and makes a claim about AI helping attackers develop exploits, but does not quantify how many October attacks used AI or compare those attacks with a verified pre-AI baseline. Its own conclusion is mixed: the evidence supports a faster exploitation cycle in some cases, while the overall volume data challenges the idea that disclosure growth translated directly into attacks.
Several details also depend on the source’s methods and attribution. CVE totals vary with whether rejected records are included, and the source notes concerns about automated assignments. The crypto-loss estimate, the amount reportedly leaving Binance and the FBI’s attribution are different claims with different bases. The supplied material does not provide the underlying incident investigation or explain the full calculation behind CertiK’s October estimate. It is also not clear from the account how many flaws linked to AI research were exploited, beyond the specific examples it identifies.
Watch Exploitation and Incident Findings
The next useful test is whether exploitation data continues to rise, and whether that rise tracks the expansion in vulnerability disclosures. CISA’s KEV additions and threat-intelligence reporting can show whether more newly disclosed flaws are being used in real attacks; the CVE count alone cannot answer that question. Security teams will also need to distinguish flaws with evidence of active exploitation from the much larger pool of published records.
Further public findings about the Binance theft may clarify its entry point, the amount ultimately lost and the basis for the FBI’s attribution. Additional reporting on PHP2Shell and other AI-assisted vulnerability work could help establish how often AI contributes to discovery, patching or exploit development. For now, October’s record figures are confirmed in the source’s account, but a broad claim that AI changed cyberattacks at scale remains unproven.
Key Questions
Did AI cause October 2026’s record number of vulnerability disclosures?
The figures do not establish that. The source reports AI involvement in security research and Microsoft patch entries, but it does not show that AI caused the 17,060 CVE records published in October.
How many new CVE records were published in October?
Thorsten Meyer’s NVD API count recorded 17,060 new CVE records in October 2026, excluding rejected records. He says the total would be 17,481 if rejected records were included.
Did confirmed exploitation rise as quickly as disclosures?
No, not in the figures provided. CISA added 36 vulnerabilities to its KEV catalog in October 2026, compared with 31 a year earlier, while the monthly CVE count rose from 4,273 to 17,060. The measures track different things and are not directly interchangeable.
What was AI’s documented role in the month’s security work?
The source says at least 65 Microsoft October security entries credited an AI model or AI vulnerability research firm. It also says OpenAI’s Patch the Planet program produced the PHP2Shell flaws, which were patched on October 21. These examples document AI involvement in research and fixes, not AI’s role in every attack.
What is known about the Binance theft?
The source reports that more than $6 billion left Binance on October 29 and says the FBI attributed the theft to North Korea’s TraderTraitor on October 31. It characterizes the incident as beginning with a compromised laptop, not an AI-found vulnerability. Further incident details are not supplied in the source material.
Source: ThorstenMeyerAI.com
