🔍 Read the full analysis: Three Threads In Black October 2026: CVEs, Crypto And AI on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis of October 2026 reports 17,060 new CVE records, 36 additions to CISA’s Known Exploited Vulnerabilities catalog and $3.47 billion in crypto losses after recovered funds. The figures describe different things: disclosures surged, while confirmed exploitation rose less sharply. The source points to AI-assisted vulnerability research and faster exploit development, but says the largest theft began with a compromised laptop and does not establish that AI caused the month’s records or losses.
A November 1 review of October security data reports 17,060 newly published CVE records, 36 additions to the U.S. government’s catalog of vulnerabilities known to be exploited, and $3.47 billion in crypto losses after frozen and returned funds. The figures point to sharply different trends: disclosures and reported crypto losses surged, while confirmed exploitation rose more modestly. The review argues that AI is beginning to affect vulnerability research and exploit development, but does not show that AI caused the month’s overall rise in records or thefts.
Thorsten Meyer, writing on ThorstenMeyerAI.com, says he counted new records in the National Vulnerability Database (NVD) through its API by publication date, excluding rejected entries. The count for October was 17,060, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October 2026, the tally reached 89,859, against 39,639 in the same period of 2025. Meyer notes that including rejected records would raise October’s figure to 17,481, illustrating how counting choices affect the total.
The exploitation figures are smaller. The Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, up from 31 in October 2025 and 17 in October 2024. CISA had added 282 so far in 2026, more than the 245 additions for all of 2025. These are catalog additions backed by evidence of exploitation, not a count of every attack or every flaw being used.
For crypto, the source attributes to blockchain security firm CertiK a net October loss estimate of $3.47 billion, after frozen and returned funds, compared with $68 million in October 2025. It says the Binance theft accounted for 96.7% of that month’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The source also reports AI-related contributions to security fixes, including at least 65 entries in Microsoft’s October security release credited to an AI model or an AI vulnerability research firm.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why the Three Measures Diverge
The gap between the disclosure and exploitation figures matters for how readers interpret a “record” month. A published CVE is not proof of an attack: disclosures include flaws that may never be exploited, and the size of the total can reflect reporting and assignment practices as well as the number of newly identified weaknesses. The source says the October CISA additions rose 16% from a year earlier while NVD records quadrupled. That comparison suggests the disclosure surge should not be read as an equivalent jump in confirmed exploitation.
For defenders, the KEV catalog offers a different, more operational signal: it identifies flaws for which CISA reports reliable evidence of active exploitation. The October additions included products used at network boundaries and in remote access, among them Ivanti and Citrix gateways, a Palo Alto Networks firewall, Fortinet and Cisco appliances, and BeyondTrust remote support, according to the review. The list also included vulnerabilities affecting Atlassian, GitLab, VMware ESX, PHP and Google’s Brotli library. That range shows why organizations need to track affected products and patch status, rather than treat a headline count as a direct measure of their own exposure.
The crypto figure has a different meaning again: it tracks reported financial losses, not software flaws. A single incident dominated the estimate, according to the source, so the month’s total does not establish a broad rise across all crypto thefts. Taken together, the ledgers describe disclosure, observed exploitation and stolen funds—related security outcomes, but not interchangeable measures or proof of a single cause.
Products Worth Considering
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How October’s Counts Were Compiled
Meyer describes October as the first month in which AI found serious flaws at scale and says fixes shipped in the same month. That is his interpretation, not a measurement established by the figures alone. His review separates three data sets: NVD records for publicly disclosed vulnerabilities; CISA’s KEV catalog for flaws with evidence of exploitation; and crypto-loss estimates compiled by CertiK. Each dataset has its own scope and counting rules.
The NVD numbers are sensitive to methodology. Meyer’s main count excludes rejected records; he says CVE identifiers themselves are not a reliable measure because numbering authorities can reserve large blocks. He also cites Google’s threat intelligence group (GTIG), which has warned that automated assignment policies can inflate totals. According to Meyer’s summary of GTIG’s findings, Linux-kernel descriptions generated about 5,000 CVEs between January and August 2026, with no observed zero-day exploitation among them.
The source says GTIG reported on September 30 that it counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. It also cites Google’s Big Sleep research project as finding more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples support a growing role for AI in vulnerability research, but they do not by themselves show that AI produced the broad October CVE increase.
What the Data Cannot Establish
The source does not provide enough detail to independently verify the underlying NVD query, CertiK’s full incident-level accounting or the FBI statement beyond its attribution to the agency. Its figures should therefore be read as reported estimates and counts, with the stated dates and methods, rather than as a complete accounting of every vulnerability or theft.
It is also unclear how much AI contributed to the month’s overall security activity. The review cites AI-linked research and fixes, and says attackers can use AI to turn patches into exploits within days. It also reports that the PHP2Shell flaws were patched on October 21 after originating in OpenAI’s Patch the Planet program, and that an embargo broke before release. Those examples do not establish that AI caused the broader rise in CVEs or that every cited exploit involved AI.
The review says the Binance theft began with a compromised laptop rather than an AI-found bug. Its account does not set out the full technical sequence, the amount ultimately recovered, or the evidence behind every part of the attribution. The alleged North Korean link is attributed to the FBI; it is not presented here as an independently verified finding.
What Security Teams Should Track
The next useful developments are updates to CISA’s KEV catalog, vendor advisories and disclosures about whether affected systems were exposed or patched. Organizations can use the catalog to identify flaws with evidence of exploitation, while checking each vendor’s guidance for affected versions and mitigations. The record CVE total alone does not identify which systems are at immediate risk.
Further reporting may clarify the Binance incident, the FBI’s attribution and the final accounting of frozen or returned funds. New details on the PHP2Shell disclosure and Microsoft’s AI-linked security release entries could also help establish how AI tools contributed to finding, fixing or exploiting specific flaws. Until then, the October figures show a sharp increase in public disclosures and reported crypto losses, but a more limited increase in cataloged exploited vulnerabilities.
Key Questions
What were the three October 2026 records reported?
The source reports 17,060 new NVD CVE records, 36 new entries in CISA’s Known Exploited Vulnerabilities catalog and $3.47 billion in crypto losses after frozen and returned funds. These are separate measures with different methods.
Does a record number of CVEs mean a record number of attacks?
No. A CVE records a publicly disclosed vulnerability; it does not by itself show that attackers used the flaw. CISA’s KEV catalog is a narrower measure based on evidence of exploitation.
What did the source say about the Binance theft?
The report says Binance accounted for 96.7% of October’s net crypto-loss estimate and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. It says the incident began with a compromised laptop, but the full technical sequence and recovery details remain unclear in the source material.
Did AI cause the October increase in vulnerabilities?
The report cites AI-assisted vulnerability research and AI-linked security fixes, but does not establish that AI caused the overall rise in CVE records. Its author explicitly describes the broader prediction as a view being tested against limited data.
Source: ThorstenMeyerAI.com
