🔍 Read the full analysis: A Guide To The AI Angle In Black October 2026’S Cybersecurity Story on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis reports that October 2026 had record vulnerability disclosures and crypto losses, while CISA’s exploited-vulnerability additions rose much less sharply. It identifies AI-assisted vulnerability research and patching, but the supplied evidence does not show that AI caused the overall surge or the Binance theft.
An analysis published November 1 found that October 2026 set records for newly published vulnerabilities and reported cryptocurrency losses, while the number of vulnerabilities added to the U.S. government’s active-exploitation catalog rose far less sharply. The figures show a mixed picture for AI’s role: the analysis documents AI-linked vulnerability research and fixes, but does not establish that AI caused the broader surge or the month’s largest theft.
The author’s count of National Vulnerability Database records found 17,060 new CVEs published in October, compared with 4,273 in October 2025. For January through October, the count was 89,859, against 39,639 in the same period last year. The figures exclude rejected records and were gathered through the NVD API; counting rejected records would put October’s total at 17,481, the author said.
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog had received 282 additions through October 2026, already above the 245 recorded over all of 2025. These are different measures: CVE publications record disclosed flaws, while KEV entries identify vulnerabilities for which CISA cites evidence of exploitation.
The analysis also cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds, compared with $68 million in October 2025. It says Binance accounted for 96.7% of October’s total. The FBI attributed the October 29 Binance theft to North Korea’s TraderTraitor group on October 31, according to the source. The analysis says Microsoft’s October security release credited an AI model or AI vulnerability research firm on at least 65 entries, including one flaw already exploited in the wild. It also links PHP flaws patched October 21, dubbed PHP2Shell, to OpenAI’s Patch the Planet program.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Three Measures, Different Risks
The figures matter because a record in vulnerability disclosures is not the same as a record in successful attacks. In October, published CVEs rose to four times the October 2025 count, while CISA’s monthly KEV additions increased from 31 to 36. The gap warns against treating every newly recorded vulnerability as an active emergency, but the higher number of exploited entries still gives security teams a substantial list to track.
For organizations, the practical concern is not simply how many flaws appear, but which affect their systems and have evidence of exploitation. The source names remote-access gateways, firewalls, support tools, software platforms, PHP, and Google’s Brotli library among October’s KEV additions. That list points to exposure across widely used infrastructure, though it does not establish that every affected product or organization was compromised.
AI is relevant in two connected ways: it may help researchers identify flaws and developers fix them, and it may help attackers turn public information into working exploits. The source presents examples of research and patching, and argues that AI can shorten the time between a fix becoming public and exploitation. That is an interpretation, not a conclusion demonstrated by the monthly totals alone. The Binance case is a clear limit on the thesis: the analysis says the theft began with a compromised laptop, not an AI-found vulnerability.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the October Counts Were Built
The article separates three “ledgers”: disclosed vulnerabilities, CISA-listed vulnerabilities with evidence of exploitation, and reported cryptocurrency losses. Each answers a different question. NVD counts depend on what is published and how records are counted; KEV additions reflect catalog decisions and evidence; crypto-loss estimates depend on accounting for stolen, frozen, or returned funds.
The author says the NVD figures were queried on the morning of November 1 by publication date, with rejected records excluded. The comparison is 3,564 October CVEs in 2024, 4,273 in 2025, and 17,060 in 2026. The source also cites Google’s Threat Intelligence Group, which said exploitation rose roughly in step with disclosures over its chosen period and that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. These figures use different methods and time windows, so they should not be treated as interchangeable.
The source flags a further caveat: automated assignment policies can increase CVE totals without showing a corresponding rise in real-world attacks. It says descriptions mentioning the Linux kernel alone produced about 5,000 CVEs from January through August 2026, with no zero-day exploitation observed for that set. Google’s Big Sleep, meanwhile, reportedly found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. These examples support a role for automation in security research, but do not by themselves explain October’s full record.
“Only about 1 in 431 vulnerabilities disclosed in 2026 was seen exploited.”
— Google Threat Intelligence Group, as cited by Meyer
What the Data Cannot Establish
The figures do not show that AI caused the record CVE count, the increase in exploited vulnerabilities, or the Binance theft. The source documents AI-linked research and patching, but gives no method for estimating how much of October’s activity was enabled by AI. Its claim that attackers are using AI to turn fixes into exploits within days is presented as the author’s interpretation; the supplied material does not give case-by-case evidence or a comparison with earlier periods.
The data also have limits. NVD counts vary depending on whether rejected records are included, and the source says automated CVE assignment can inflate totals. KEV additions are not a direct count of all attacks, while crypto-loss estimates can change when funds are frozen or returned. The source does not provide the full methodology behind CertiK’s estimate, the details of the FBI attribution, or documentation for each Microsoft AI credit. Those questions leave the scale and causal role of AI in October’s security events unresolved.
Tracking Exploitation After Disclosure
The next useful test is whether the gap between disclosure and exploitation changes in the months ahead. Security teams and readers can track monthly NVD publications alongside KEV additions, while keeping their different definitions and time windows clear. More detailed incident reporting could show whether AI-assisted exploitation is becoming common and how quickly attacks follow public fixes.
For organizations, the immediate response is to check whether systems they operate are affected by vulnerabilities on CISA’s catalog and follow vendor guidance on patches and mitigations. The source provides no announced follow-up investigation, formal AI-attribution study, or next milestone for the Binance case. Its November 1 snapshot should be treated as a point-in-time assessment, not a final account of October’s incidents.
Key Questions
What was the main cybersecurity development in October 2026?
The analysis reports 17,060 new NVD CVE records in October, the month’s highest count in its dataset, alongside 36 new additions to CISA’s Known Exploited Vulnerabilities catalog and an estimated $3.47 billion in crypto losses.
Does the record CVE count mean attacks also reached a record?
Not by itself. CVEs count published vulnerability records; CISA’s KEV catalog tracks flaws with evidence of exploitation. The analysis reports that monthly KEV additions rose from 31 in October 2025 to 36 in October 2026, far less than the increase in CVE publications.
What evidence links AI to October’s cybersecurity activity?
The source says Microsoft’s October security release credited an AI model or AI vulnerability research firm on at least 65 entries, and links the PHP2Shell flaws patched on October 21 to OpenAI’s Patch the Planet program. It also cites Google’s Big Sleep research. Those examples show reported AI involvement in finding or fixing flaws, but do not establish that AI caused the overall surge in disclosures or attacks.
Who did the FBI blame for the Binance theft?
According to the source analysis, the FBI attributed the October 29 theft to North Korea’s TraderTraitor group on October 31. The supplied material says the incident began with a compromised laptop, not an AI-found software flaw.
Source: ThorstenMeyerAI.com
