🔍 Read the full analysis: Black October 2026: A Closer Look At AI In The Cybersecurity Fight on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, according to figures cited by ThorstenMeyerAI.com. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog; the figures show a sharp gap between disclosures and documented exploitation. AI tools helped identify some flaws, but the source does not establish that AI caused the month’s broader rise in attacks or losses.
October 2026 set records for published vulnerability records and reported cryptocurrency losses, while the number of newly listed flaws with evidence of exploitation rose more modestly. A review published November 1 by ThorstenMeyerAI.com also documented AI-assisted vulnerability research and fixes, but the figures do not show that AI drove the month’s overall increase in cyber incidents.
The review’s count of National Vulnerability Database (NVD) records found 17,060 new CVEs published in October, excluding rejected records. That was nearly four times October 2025’s 4,273. From January through October, the review counted 89,859 records, compared with 39,639 over the same period in 2025. These are publication counts, not a count of attacks or confirmed exploitable flaws.
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog tracks vulnerabilities for which there is evidence of exploitation. CISA’s additions reached 282 in the first ten months of 2026, above the 245 additions recorded across all of 2025. Separately, the review cited CertiK’s estimate of $3.47 billion in October crypto losses, after frozen and returned funds were accounted for; it said Binance represented 96.7% of that total.
The report identified examples of AI contributing to defensive research. It said at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It also said PHP flaws dubbed PHP2Shell were found through OpenAI’s Patch the Planet program and patched on October 21. These examples document specific research and remediation work, not a general measure of AI’s effect on cybersecurity.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The central finding is the gap between the volume of reported flaws and evidence that attackers used them. CVEs describe publicly recorded vulnerabilities; CISA’s KEV additions reflect flaws with reliable evidence of active exploitation. In October, CVE publication was almost four times its year-earlier level, while KEV additions rose from 31 to 36. Those measures cover different things and should not be treated as interchangeable indicators of harm.
That distinction matters to security teams facing limited time and staff. A larger disclosure pool can make triage harder, but it does not mean every new record presents the same immediate risk. The review says October’s KEV entries included flaws affecting remote-access gateways, firewalls, support tools and widely used software. Confirmed exploitation and exposure are more useful prioritization signals than a raw monthly CVE total alone.
The losses figure also needs careful reading. The review attributes most of October’s reported crypto loss total to one Binance incident, rather than to a broad tally of unrelated incidents of similar scale. It says the FBI attributed the theft to North Korea’s TraderTraitor on October 31. That makes the total an important measure of reported financial impact, but not evidence that AI caused the theft.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Jackery Explorer 2000 v2 Portable Power Station, 2042Wh
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
Three Different Security Measures
The review separates October’s figures into three ledgers: disclosed vulnerabilities, vulnerabilities listed as exploited, and reported crypto losses. Each measures a different stage or type of security event. A CVE record can be published without evidence that anyone has exploited it; a KEV entry requires evidence of exploitation; crypto losses track stolen funds and may later change when funds are frozen or returned.
Method affects the disclosure count. The author says the NVD query was run on the morning of November 1, counted records by publication date and excluded rejected records. Under that method, October 2026 had 17,060 records; including rejected records would raise the figure to 17,481. The review also cites Google’s threat intelligence group, which warned that automated assignment policies can inflate CVE totals. It reported that descriptions mentioning the Linux kernel produced about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that subset.
For longer-term comparison, the review says Google’s threat intelligence group counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 across all of 2025. That suggests exploitation was rising, while still not matching the much faster growth in published CVEs. The report’s comparisons depend on the dates and counting methods stated for each dataset.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Counts Cannot Show
The figures do not establish that AI caused the CVE increase, the rise in exploitation, or the crypto theft. The reported AI contributions concern particular research and patching cases; the source provides no comparable baseline showing how many flaws would have been found or fixed without AI. Nor does a CVE publication count tell readers how many records represent serious, reachable risks.
The review’s exploitation measure also has limits: KEV additions are catalog updates, not a complete census of every attack. The source cites Google’s estimate that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited, but the supplied material does not provide the full methodology behind that ratio. Crypto estimates can change as funds are frozen or returned, and the material does not include a detailed breakdown of the Binance incident’s mechanics.
Meyer argues that attackers can use AI to turn fixes into exploits quickly and says the PHP2Shell embargo broke before release. Those are claims in the source, not independently established findings in the supplied material. The source also says the Binance theft began with a compromised laptop rather than an AI-found vulnerability; the provided account does not give enough detail to assess that claim independently.
Track Patches and Exploitation Evidence
Security teams will need to track whether October’s disclosed flaws receive patches and whether new evidence puts more of them into CISA’s KEV catalog. The review’s figures are a snapshot taken around November 1; later catalog updates and revisions to loss estimates could change the picture. Organizations should assess systems they use against confirmed advisories and prioritize flaws with evidence of exploitation, rather than treating every CVE as equally urgent.
The next useful test of the AI thesis will be documented cases that connect tools to outcomes: which flaws AI systems found, how quickly vendors fixed them, whether attackers exploited them, and what role AI played in those attacks. Until those links are established across more cases, October’s records show AI-assisted defensive work alongside rising disclosures and losses, but do not establish AI as the cause of the month’s cybersecurity trends.
Key Questions
How many vulnerability records were published in October 2026?
The review counted 17,060 new NVD CVE records by publication date, excluding rejected records. Including rejected records would produce a different total: 17,481.
Did exploitation rise as quickly as vulnerability disclosures?
No. The review counted 36 CISA KEV additions in October 2026, up from 31 in October 2025, while monthly CVE publications rose from 4,273 to 17,060. The measures track different things, and KEV additions are not a complete count of all attacks.
What role did AI play in the October findings?
The source reports AI-related credits on at least 65 Microsoft security-release entries and says OpenAI’s Patch the Planet program found the PHP2Shell flaws. These examples show specific research contributions, but do not prove AI caused the overall rise in disclosures, exploitation or losses.
What was the reported scale of October’s crypto losses?
The review cites CertiK’s estimate of $3.47 billion in losses after frozen and returned funds were accounted for. It says Binance represented 96.7% of the total and reports that the FBI attributed the Binance theft to North Korea’s TraderTraitor.
Source: ThorstenMeyerAI.com
