🔍 Read the full analysis: Black October 2026: What Happened When AI Appeared On Both Sides? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 saw 17,060 CVE records published and $3.47 billion in reported crypto losses, according to the source’s counts. AI-assisted research contributed to vulnerability discoveries and fixes, but the data do not show that the disclosure surge translated into a comparable rise in exploitation. The FBI attributed the Binance theft to North Korea’s TraderTraitor group; the source says the incident began with a compromised laptop.
Meyer says he counted NVD records by publication date using its API, excluding rejected records. The October total was four times October 2025’s 4,273. From January through October, the count reached 89,859, compared with 39,639 over the same months in 2025. The source notes that including rejected records would put October 2026 at 17,481, underscoring that totals depend on counting rules.
A separate measure offers a more limited increase. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA had added 282 so far in 2026, already above the 245 additions recorded throughout 2025. These figures track flaws for which CISA lists evidence of exploitation; they are not a count of every attack.
The review says CertiK counted $3.47 billion in October crypto losses after accounting for frozen and returned funds, versus $68 million in October 2025. It attributes 96.7% of the month’s total to Binance. The FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31, according to Meyer. The review also says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The gap between published flaws and documented exploitation changes how the record figures should be read. CVE disclosures can reflect more researchers and automated reporting, not just a sudden rise in attacks. Meyer cites Google’s Threat Intelligence Group (GTIG), which said exploitation had risen roughly in step with disclosure and estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That figure does not mean the remaining flaws are harmless; it shows why disclosure totals alone cannot measure real-world attack activity.
For security teams, the CISA catalog provides a narrower signal about flaws with evidence of active use. Its 36 October additions were up on the prior year, but by much less than the fourfold increase in monthly CVE records. Meanwhile, the crypto-loss figure represents a different kind of risk entirely: an outcome measured in stolen funds, not a count of software weaknesses. Keeping the disclosure, exploitation and loss measures separate helps readers avoid treating them as interchangeable proof of an AI-driven wave.
The AI findings matter because they show AI tools entering both sides of vulnerability work. Researchers used them to identify flaws that could then be fixed, while attackers can use AI to help turn public technical information into working exploits. The source argues that some attacks can follow fixes within days, but its numbers do not establish that AI caused October’s overall CVE volume or the Binance theft.
Popular right now
Dyson Ball Animal 3 Upright Vacuum
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Evidence
Meyer’s review separates the month into three ledgers: disclosed vulnerabilities, vulnerabilities listed as exploited, and reported crypto theft. A CVE is a public record that a vulnerability exists. The NVD total counts records, not successful attacks, and the review cautions that reporting practices can inflate the number without indicating equivalent growth in risk.
For example, GTIG said descriptions mentioning the Linux kernel produced about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation among that set, according to the source. GTIG also reported 141 distinct vulnerabilities disclosed and exploited from January through August, more than the 127 it counted for all of 2025. These are distinct measures and time windows, so they should not be conflated with the NVD’s October publication count.
The review links some AI-assisted discovery to concrete patching. It says the PHP2Shell flaws were found through OpenAI’s Patch the Planet program and patched on October 21. It also reports that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. Those examples show documented research activity, not a complete accounting of AI’s role in October’s security incidents.
“The gap matters: Exploitation grew far less than disclosure.”
— Thorsten Meyer, in the November 1 review
What the Figures Cannot Show
The available figures do not establish how much AI contributed to October’s disclosure spike, exploitation activity or crypto losses. The source documents AI-assisted research and argues that AI can speed exploit development, but it does not quantify AI’s role across attacks during the month. It also says the Binance theft began with a compromised laptop, rather than an AI-found software flaw.
There are measurement limits. CVE totals vary depending on whether rejected records are included and on how numbering authorities assign records. CISA’s KEV additions reflect catalog updates and evidence available to the agency, not a census of all exploitation. The source’s crypto total is attributed to CertiK and adjusted for frozen and returned funds; the provided material does not supply a separate breakdown of the underlying transactions or explain the full attribution process.
The source also says PHP2Shell’s embargo broke before its October 21 release, but does not provide enough detail here to establish who disclosed the information early, how it was used, or whether that event led to a specific attack. The extent of any resulting harm remains unclear.
Further Evidence Will Matter
The next useful indicators will be updates to CISA’s KEV catalog and follow-up reporting on the October vulnerabilities, particularly whether more flaws receive evidence-backed exploitation listings. That could help distinguish a temporary publication surge from a lasting increase in vulnerabilities used by attackers.
Further information about the Binance incident may clarify the attack sequence and the FBI’s attribution to TraderTraitor. The source does not set out a coming investigation milestone or state whether additional funds may be recovered. For the AI claims, more detailed disclosures about the PHP2Shell research, patch timing and any confirmed exploitation would help show how the tools affected the process.
For now, the evidence supports a record month for disclosed CVEs and reported crypto losses, plus documented AI-assisted security research. It does not support treating those facts as proof that AI caused a corresponding record in successful attacks. Whether AI is changing the speed or scale of exploitation will depend on incident-level evidence and comparable data in the months ahead.
Key Questions
What records did October 2026 set?
According to Thorsten Meyer’s review, the NVD published 17,060 new CVE records in October, while CertiK counted $3.47 billion in crypto losses after frozen and returned funds. These are separate measures and do not both represent counts of cyberattacks.
Did exploited vulnerabilities rise as much as CVE disclosures?
No. CISA added 36 vulnerabilities to its KEV catalog in October, compared with 31 in October 2025, while NVD disclosures rose from 4,273 to 17,060 over the same comparison. The catalogs measure different things, and their totals should not be read as directly equivalent.
What role did AI play in the reported security work?
The review says AI models or AI vulnerability research firms were credited in at least 65 entries in Microsoft’s October security release. It also links PHP2Shell to OpenAI’s Patch the Planet program and reports findings by Google’s Big Sleep. These examples document research contributions but do not quantify AI’s role in attacks overall.
Who did the FBI blame for the Binance theft?
Meyer’s review says the FBI attributed the theft to North Korea’s TraderTraitor group on October 31. The source describes a compromised laptop as the starting point; it does not characterize the theft as the result of an AI-discovered software flaw.
Source: ThorstenMeyerAI.com
