🔍 Read the full analysis: From Record CVEs To Crypto Theft: Where AI Fits In Black October 2026 on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record 17,060 published CVE records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog, while CertiK estimated crypto losses at $3.47 billion. The source links AI to vulnerability discovery and faster exploit development, but the data do not show that AI caused the disclosure surge or Binance theft.
October 2026 set records for newly published vulnerability records and reported crypto losses, but the available figures point to a more limited rise in documented exploitation. A November 1 analysis by Thorsten Meyer says the National Vulnerability Database published 17,060 CVE records during the month, while CertiK counted $3.47 billion in crypto losses, most of it associated with a theft from Binance that the FBI attributed to North Korea’s TraderTraitor group.
Meyer says his count from the NVD API, excluding rejected records, found 17,060 October publications, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count reached 89,859, against 39,639 in the same period of 2025. The source notes that including rejected records raises October 2026’s figure to 17,481, and says its counts are based on publication date.
The rise in disclosures did not match the increase in entries on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. CISA added 36 flaws in October, compared with 31 in October 2025 and 17 in October 2024. Its total additions for January through October 2026 stood at 282, exceeding the 245 additions for all of 2025. The catalog is intended to list flaws for which there is evidence of exploitation, rather than every published vulnerability.
On the crypto ledger, CertiK’s estimate was $3.47 billion in October losses after accounting for frozen and returned funds, versus $68 million in October 2025. The source says Binance accounted for 96.7% of the October total and reports that the FBI attributed the October 29 theft to North Korea’s TraderTraitor on October 31. It also says Microsoft’s October security release credited an AI model or AI vulnerability research firm on at least 65 entries, including one flaw already exploited in the wild.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Three Security Measures, Different Signals
The figures matter because they describe different stages of security risk, not one interchangeable measure of a “record month for hacks.” CVE publications track flaws made public; CISA’s catalog tracks vulnerabilities with evidence of active exploitation; crypto-loss estimates track money reportedly taken. A sharp increase in one ledger does not establish an equivalent increase in the others.
That distinction tempers the claim that AI has triggered a broad surge in successful attacks. Meyer’s figures show disclosures grew far faster than CISA additions: October CVEs were about four times the October 2025 count, while KEV additions rose from 31 to 36. The source also cites Google Threat Intelligence Group’s estimate that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. These numbers do not rule out faster attacks against selected flaws, but they do not support treating every new CVE as an active threat.
For security teams, the practical implication is to prioritize evidence and exposure, not raw publication totals alone. The source points to vulnerabilities in remote-access products, firewalls, support tools and widely used software among October’s KEV additions. At the same time, the Binance theft is a reminder that a headline-grabbing financial loss may stem from a compromised endpoint rather than a newly discovered software flaw.
Products Worth Considering
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
How the October Counts Were Built
Meyer’s analysis separates the month into disclosed, exploited and stolen measures. For CVEs, he queried the NVD API on the morning of November 1 for records by publication month from January 2024 onward, excluding rejected records. He cautions that totals depend on counting rules and says CVE identifiers themselves are not a reliable count of published flaws, because numbering authorities can reserve blocks of IDs.
The source also reports that automated assignment policies can affect disclosure totals. Citing Google Threat Intelligence Group, it says descriptions referring to the Linux kernel accounted for about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation of those entries. That is an attributed finding, not evidence that all such records are invalid or harmless.
On AI-related vulnerability work, the source says OpenAI’s Patch the Planet program produced the PHP2Shell findings, which were patched on October 21. It also cites Google’s Big Sleep project as finding more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month comparison. The source argues that AI can help researchers find flaws and can help attackers turn fixes into exploits, but those propositions need to be assessed case by case.
“That is my view, not a measurement.”
— Thorsten Meyer, describing his view of the coming threat landscape
AI’s Role Is Not Settled
The source does not establish that AI caused the October CVE record or the Binance theft. It describes AI-linked vulnerability discoveries and argues that attackers can use AI to develop exploits from fixes quickly, but it does not provide a complete, independently verified count of attacks enabled by AI. The claim that embargoed flaws became public before release is also presented as part of Meyer’s assessment; the supplied material gives no detailed timeline or evidence for every affected disclosure.
Some figures remain sensitive to definitions. NVD totals change if rejected records are included, while crypto-loss totals depend on estimates and treatment of frozen or returned funds. The provided material also does not include a detailed account of how the Binance laptop was compromised, the precise amount directly attributable to that incident, or supporting documentation for the FBI’s attribution. The FBI attribution is reported by Meyer and should not be treated here as independently verified.
The source’s comparison between the number of CVEs and KEV additions is informative but not a direct conversion rate: the catalogs use different criteria and timing. Nor does a low observed exploitation ratio establish that undiscovered or unreported attacks did not occur. The figures describe what was counted and reported by the stated dates.
Track Exploitation and Investigation Updates
The next useful indicators are whether CISA continues adding vulnerabilities at the pace recorded so far in 2026, whether security researchers document more AI-assisted discovery or exploitation, and whether additional evidence emerges about the Binance theft. Updates to NVD entries and the KEV catalog may also change how October’s totals are understood.
For defenders, the immediate focus is on the specific products and flaws listed by CISA, alongside vendor patches and incident guidance. Meyer’s report frames October as a test of the idea that AI is changing both vulnerability research and attacks; further months of comparable data, with consistent methods and attributed incident evidence, will be needed to judge whether that pattern holds.
Key Questions
What records did October 2026 set?
According to Thorsten Meyer’s NVD API count, October had 17,060 published CVE records, excluding rejected records. CertiK counted $3.47 billion in crypto losses for the month after frozen and returned funds were accounted for. The source describes both as records in their respective measures.
Did exploitation rise as much as CVE disclosures?
No, not in the reported figures. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, up from 31 in October 2025, while the NVD publication count rose from 4,273 to 17,060. The two measures use different criteria and should not be read as a direct conversion rate.
What did the report say about AI and vulnerability research?
It says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm. It also attributes the PHP2Shell findings to OpenAI’s Patch the Planet program and cites Google’s Big Sleep project. These cases show AI’s involvement in some research; they do not establish that AI caused the overall rise in CVEs.
Who did the FBI attribute the Binance theft to?
Meyer’s report says the FBI attributed the October 29 theft to North Korea’s TraderTraitor group on October 31. The supplied material does not include the FBI’s underlying evidence or a detailed account of how the theft occurred.
What remains unknown about AI-assisted attacks?
The report does not provide a complete count of attacks enabled by AI or establish how often AI was used to turn vulnerability fixes into working exploits. It presents that risk as Meyer’s assessment and says the largest crypto loss of the month began with a compromised laptop, not an AI-found flaw.
Source: ThorstenMeyerAI.com
