🔍 Read the full analysis: Black October 2026: Exploring AI’s Role In The Fight Against Cyber Threats on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 saw 17,060 new CVE records published and $3.47 billion in crypto losses, according to the source’s NVD tally and CertiK figures. The source also reports AI-linked vulnerability discoveries and fixes, but CISA’s exploited-flaw additions rose far less than CVE disclosures. The figures do not establish that AI caused the month’s surge in vulnerabilities or losses.
A report published November 1 says October 2026 set records for published vulnerability disclosures and reported cryptocurrency losses, while the increase in flaws added to the U.S. government’s exploited-vulnerability catalog was much smaller. The figures offer a mixed picture of AI’s role in cybersecurity: the report identifies AI-linked discoveries and fixes, but does not show that AI caused the wider rise in disclosures or theft.
The report’s author says a query of the National Vulnerability Database (NVD) found 17,060 new CVE records published in October, excluding rejected records. That compares with 4,273 in October 2025. Across January to October, the tally was 89,859 in 2026 and 39,639 in 2025. These are disclosure counts, not counts of attacks or confirmed exploitable weaknesses. The author says including rejected records would raise October’s figure to 17,481.
The exploitation figures were lower. The CISA Known Exploited Vulnerabilities catalog received 36 additions in October, compared with 31 in October 2025 and 17 in October 2024. For January to October, the catalog added 282 flaws in 2026, above the 245 additions recorded across all of 2025. The report says five October additions concerned older vulnerabilities for which new evidence of exploitation had emerged.
For cryptocurrency losses, the report cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds were accounted for, against $68 million in October 2025. It says the Binance theft accounted for 96.7% of the month’s total. The report attributes the October 29 incident to North Korea’s “TraderTraitor” group, citing an FBI attribution dated October 31. These estimates and attribution are reported claims, not independently established here.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The figures matter because vulnerability disclosures, confirmed exploitation and financial losses describe different parts of the threat picture. A sharp rise in CVEs can give defenders more records to review, but does not mean attackers exploited every flaw. In October, the source’s disclosure count rose far faster year over year than CISA’s additions to its exploited catalog. That gap argues against treating the CVE record alone as proof of a matching surge in attacks.
The report says Google Threat Intelligence Group (GTIG) found exploitation had risen roughly in step with disclosures over its measured period and estimated that about one in 431 vulnerabilities disclosed in 2026 had been seen exploited. It also reports that zero-day activity rose moderately, from an average of eight to 11 per month. The underlying time periods and methods matter when interpreting these comparisons; the figures do not show that most newly disclosed flaws were used in attacks.
For security teams, the practical issue is prioritization: disclosure volume can overwhelm routine review, while evidence of active exploitation helps identify flaws needing urgent attention. The report’s account of AI-assisted research points to a possible benefit—finding and fixing vulnerabilities sooner—but its discussion of attackers turning fixes into exploits quickly is a warning, not proof that AI caused a specific attack wave.
Products Worth Considering
Jackery Solar Generator 1000 v2 with 200W Solar Panel
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
How the Three Counts Differ
The author separates the month into three measures: disclosed, exploited and stolen. CVE records document publicly identified vulnerabilities; CISA’s KEV catalog lists flaws for which it has evidence of active exploitation; crypto-loss estimates track stolen assets. They have different definitions and collection methods, so a record in one measure does not automatically predict a record in another.
The source says the NVD tally was made through its API on the morning of November 1, counting publication dates since January 2024 and excluding rejected records. It also cautions that CVE totals can reflect assignment practices and reporting volume. Citing GTIG, it says roughly 5,000 CVEs related to Linux-kernel descriptions were recorded from January through August 2026, with no observed zero-day exploitation in that group. That example illustrates why disclosure volume is not an attack count.
On AI, the report says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability-research firm, including one flaw already exploited in the wild. It says OpenAI’s Patch the Planet program produced the PHP2Shell findings, patched on October 21, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These are examples of research and remediation, not evidence that AI independently caused October’s overall records.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, report author
What the October Data Cannot Prove
The figures do not establish that AI caused the increase in CVE disclosures, exploitation or crypto theft. The report gives examples of AI-linked vulnerability research, but does not provide a method for measuring how much AI contributed to the month’s aggregate totals. Nor does it establish that AI was used in the Binance theft.
The source says the Binance incident began with a compromised laptop, rather than an AI-found vulnerability. The FBI attribution to North Korea’s “TraderTraitor” is reported as an official assessment, but the supplied material does not include the FBI’s supporting evidence or a detailed account of how the compromise occurred. The precise scope of funds ultimately recovered, and how CertiK calculated the loss total, also cannot be assessed fully from the material provided.
Other limits include differences in counting methods and time windows. The NVD figures exclude rejected records, while other tallies may not; the report itself gives a higher number when rejected records are included. CISA catalog additions reflect newly listed flaws and evidence, not every exploitation event. The author’s prediction of more attacks and public disclosures remains a forecast, not a confirmed outcome.
Tracking Exploitation and Patch Response
The next useful test is whether the elevated disclosure pace continues and whether confirmed exploitation rises alongside it. Security teams and researchers can watch subsequent NVD publication totals and CISA KEV updates, while keeping each measure’s definition and reporting window in view. The October figures alone cannot establish a lasting trend.
For the AI examples, further detail about the flaws, research methods and patch timelines would help clarify what the tools contributed and whether defenders gained time before exploitation. The report also points to the importance of tracking cases where vulnerability details become public before a fix is available, but supplies no complete accounting of such incidents for October.
Readers should also look for additional official information on the Binance theft and any revised loss estimates or recovery figures. Until those details and comparable data for later months are available, October is best read as a month with extraordinary disclosure and reported-loss totals, but a more limited rise in cataloged exploited flaws—not as proof that AI drove a new wave of cyberattacks.
Key Questions
How many vulnerabilities were published in October 2026?
The report author counted 17,060 new NVD CVE records published in October, excluding rejected records. The author says the count would be 17,481 if rejected records were included.
Did confirmed exploitation rise as quickly as vulnerability disclosures?
No. The source reports 36 October additions to CISA’s Known Exploited Vulnerabilities catalog, compared with 31 a year earlier, while its NVD disclosure count rose from 4,273 to 17,060. Those measures track different things and should not be treated as directly interchangeable.
What role did AI play in the October findings?
The report identifies AI models and research firms credited in at least 65 entries in Microsoft’s October security release, and describes findings linked to OpenAI’s Patch the Planet program and Google’s Big Sleep. It does not quantify AI’s contribution to all disclosures or establish that AI caused the month’s wider cyber activity.
What does the report say about the Binance theft?
It cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds, with Binance accounting for 96.7% of the total. It says the FBI attributed the October 29 theft to North Korea’s “TraderTraitor” group on October 31. The supplied material does not give the full evidence or incident details.
Source: ThorstenMeyerAI.com
