🔍 Read the full analysis: What Record CVEs And A Crypto Heist Say About AI In Black October 2026 on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 set a monthly record with 17,060 published CVE records, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. CertiK counted $3.47 billion in crypto losses after frozen and returned funds, with the FBI attributing the Binance theft to North Korea; the source says a compromised laptop was involved, not an AI-found flaw. AI-linked research contributed to some bugs and fixes, but the figures do not establish that AI caused the wider rise in vulnerabilities or attacks.
October 2026 set records for newly published vulnerability records and reported cryptocurrency losses, but the available figures show a much smaller rise in flaws added to the U.S. government’s active-exploitation list. A November 1 review by ThorstenMeyerAI.com also documents AI involvement in vulnerability research and fixes, while cautioning that the month’s biggest reported theft was attributed to North Korea and began with a compromised laptop, not an AI-discovered bug.
The review says the U.S. National Vulnerability Database published 17,060 new CVE records in October, excluding rejected records. That was four times the October 2025 count of 4,273. From January through October, the count reached 89,859, compared with 39,639 over the same period in 2025. The author says the figures came from an NVD API query on November 1; including rejected entries would put October at 17,481.
Active exploitation rose less sharply. The Cybersecurity and Infrastructure Security Agency added 36 flaws to its Known Exploited Vulnerabilities catalog in October, against 31 in October 2025 and 17 in October 2024. Its year-to-date additions reached 282, already above the 245 added during all of 2025. Five October additions were older vulnerabilities, from 2015 to 2023, for which new evidence of exploitation had emerged.
CertiK counted $3.47 billion in October crypto losses after accounting for funds frozen or returned, compared with $68 million in October 2025. The review says the Binance incident accounted for 96.7% of that month’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. Those figures and attribution are reported by the source; details of the incident and its causes should be distinguished from the broader cybersecurity statistics.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Known Exploitation
The gap between vulnerability disclosures and confirmed exploitation is central to interpreting October’s record. CVE counts measure published records, not successful attacks or the number of flaws that pose equal risk. CISA’s catalog is narrower: it lists vulnerabilities for which the agency reports reliable evidence of active exploitation. In October, its 36 additions rose 16% from a year earlier, while monthly CVE disclosures quadrupled.
That distinction affects how organizations should read a record headline. A swelling list creates more work for security teams, but the source’s figures do not mean every newly recorded issue is being used by attackers. The review cites Google’s threat intelligence group as saying that exploitation has risen roughly in step with disclosure over a longer period, and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The source also reports that zero-day discoveries rose moderately, from an average of eight a month to 11; neither statistic proves that AI caused the increase.
The crypto figure adds a different kind of warning: financial losses do not identify the method used in an attack. The review says the Binance theft began with a compromised laptop, challenging any simple account in which AI-generated vulnerabilities explain the month’s biggest incident. For defenders, the month points to several risks that need separate tracking: disclosure volume, verified exploitation and theft.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Apple MacBook Pro 2023 with M2 Pro Chip, 14‑inch, 16 GB RAM, 512 GB SSD – Space Gray
As an affiliate, we earn on qualifying purchases.
How the Three Security Counts Differ
The review organizes the month into three separate measures: disclosed, exploited and stolen. A CVE is a public record that a vulnerability exists; the author notes that more records can reflect additional research or reporting practices as well as more flaws. CISA’s KEV catalog tracks vulnerabilities with evidence of use in attacks. Crypto-loss estimates count reported financial theft, a separate outcome that cannot by itself establish which vulnerability or technique was involved.
The author’s NVD count excludes rejected records and uses publication dates. The review notes that automated assignment policies can affect totals: Google’s threat intelligence group reportedly found that descriptions mentioning the Linux kernel alone generated about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation in that set. The source also says numbering authorities may reserve blocks of CVE identifiers, so identifiers assigned are not interchangeable with published records.
There are documented AI-related findings in the source material. It says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It also says PHP2Shell vulnerabilities were patched on October 21 after emerging from OpenAI’s Patch the Planet program, and Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show AI’s presence in security research, but do not establish that AI produced the month’s overall CVE surge.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, ThorstenMeyerAI.com
AI’s Role Is Not Yet Measured
The figures do not establish that AI caused October’s record CVE volume, nor do they show how much AI contributed to the increase in exploitation or crypto losses. The author argues that attackers can use AI to turn fixes into exploits within days and says the PHP2Shell embargo broke before release, but the supplied material does not quantify the extent of that activity or establish a direct link between AI and particular attacks.
The review also reports a figure of 17,060 published CVEs and a separate figure of 17,481 with rejected entries included, illustrating how counting rules affect the headline. It does not provide a full breakdown of the 65 Microsoft release entries or the specific evidence behind every AI attribution. The FBI attribution of the Binance theft is reported by the source, but the supplied account does not detail the investigation, the compromised laptop, or the method used to move the funds.
More broadly, the NVD, KEV and crypto-loss totals capture different events and time windows. They cannot be combined into a single measure of AI-driven cyber risk. The source’s longer-term figures and individual examples are informative, but a causal conclusion would require more evidence about attacker methods and the role of AI in each incident.
Tracking Exploits and AI Evidence
The immediate next step is to watch for further updates to the NVD and CISA KEV catalog, including whether newly disclosed October vulnerabilities receive confirmed exploitation evidence. Security teams will also need to prioritize flaws based on exposure and reliable evidence of use, rather than treating all CVE entries as equivalent.
Further reporting on the Binance incident may clarify the laptop compromise, the flow of funds and the basis for the FBI’s attribution. The source does not give a timetable for those details. Future data on AI-assisted discoveries, patches and exploit development could also test Meyer’s argument more directly. For now, October’s records show high disclosure volume, a smaller increase in cataloged exploitation and a large crypto-loss estimate; they do not yet establish a single AI-driven cause.
Key Questions
What was the October 2026 CVE record?
The review reports 17,060 new NVD records published in October, excluding rejected entries. It says the count was four times October 2025’s 4,273; including rejected records produces a different total.
Did known exploitation increase as much as CVE disclosures?
No. CISA added 36 vulnerabilities to KEV in October, up from 31 a year earlier, while the monthly CVE count quadrupled. The measures track different things: published records versus flaws with evidence of active exploitation.
Was the Binance theft caused by AI?
The source does not say that. It reports that the FBI attributed the theft to North Korea’s “TraderTraitor” and says the incident began with a compromised laptop, not an AI-found vulnerability.
What evidence links AI to October’s security activity?
The review cites AI-linked vulnerability research and fixes, including Microsoft release credits, OpenAI’s Patch the Planet program and Google’s Big Sleep findings. These examples show AI’s use in security work but do not prove it caused the overall rise in CVEs, exploitation or theft.
Source: ThorstenMeyerAI.com
