🔍 Read the full analysis: Black October 2026: Three Cybersecurity Developments And AI On Both Sides on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 brought a record 17,060 published CVE records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog, according to the source’s counts. The source also reports a major Binance theft that the FBI attributed to North Korea, alongside security fixes linked to AI research. The figures measure different things, and they do not show that AI caused the increase in disclosures or attacks.
A review of October 2026 cybersecurity data reports a record 17,060 new CVE records, while the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its list of flaws known to be exploited. The same review reports that the FBI attributed a major Binance theft to North Korea, and points to AI-linked vulnerability research and fixes—but its figures do not establish that AI caused the broader rise in vulnerabilities or attacks.
The review, published by Thorsten Meyer on November 1, says its count of new records in the National Vulnerability Database (NVD) is based on publication dates and excludes rejected records. By that method, October’s 17,060 records were four times the 4,273 recorded in October 2025. From January through October, the review counted 89,859 records in 2026, compared with 39,639 over the same period in 2025. These are disclosure counts, not counts of attacks or confirmed exploitable incidents.
CISA’s Known Exploited Vulnerabilities (KEV) catalog presents a narrower measure: flaws for which the agency has evidence of exploitation. The review says the catalog gained 36 entries in October, up from 31 in October 2025 and 17 in October 2024. It counted 282 additions from January through October 2026, exceeding the 245 additions recorded during all of 2025. The gap between the records and KEV additions is substantial, but the two figures track different categories and should not be treated as directly interchangeable.
The review also cites CertiK’s estimate of $3.47 billion in October crypto losses after accounting for frozen and returned funds, compared with $68 million in October 2025. It says Binance accounted for 96.7% of the October total. According to the review, the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. Separately, it identifies Microsoft security-release entries credited to AI models or AI research firms, and says OpenAI’s Patch the Planet program produced research behind PHP flaws patched on October 21.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Counts Outrun Exploitation Evidence
The figures point to a large gap between disclosed flaws and flaws listed as exploited. Meyer’s NVD count rose much faster than October additions to CISA’s KEV catalog. That matters for security teams because a flood of disclosures can increase the work of tracking and prioritizing patches, but the raw number of records does not tell an organization which flaws attackers are using against its systems.
The review cites Google’s threat intelligence group (GTIG), which reported that roughly one in 431 vulnerabilities disclosed in 2026 had been observed exploited, and said exploitation had risen roughly in step with disclosure. That statistic and Meyer’s monthly counts use distinct datasets and measures. Taken together, they caution against treating a record disclosure month as proof of a matching surge in successful attacks.
The AI examples show a second, more specific issue: AI tools are being used in vulnerability research, while attackers may also use AI to work from public technical information. The source argues that fixes can be turned into exploits quickly, but that is its interpretation, not a conclusion established by the monthly totals. The reported Binance incident also illustrates why cyber losses cannot be explained by vulnerability counts alone: the source says the theft began with a compromised laptop, not an AI-discovered software flaw.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Questions
The review separates cybersecurity activity into three “ledgers”: disclosed vulnerabilities, flaws listed as actively exploited, and reported crypto theft losses. An NVD CVE record documents a vulnerability; it does not by itself show that the flaw has been exploited. CISA’s KEV catalog is intended to identify vulnerabilities with reliable evidence of exploitation. Crypto-loss estimates track a different kind of event and may be revised as funds are frozen or returned.
The source says its NVD figures came from an API query conducted on the morning of November 1, with rejected records excluded. It notes that counting rejected records would put October 2026 at 17,481. It also warns that CVE assignment and publication practices affect totals, citing GTIG’s observation that descriptions involving the Linux kernel generated about 5,000 CVEs from January through August, with no observed zero-day exploitation of those entries. That example underscores why record volume is not a direct measure of attacker activity.
For the exploited-flaw comparison, the review cites the KEV catalog version dated October 30, 2026. It says five of October’s 36 additions were older vulnerabilities, dating from 2015 to 2023, for which new evidence of exploitation had emerged. The catalog entries included products such as remote-access gateways, security appliances, remote-support tools and software platforms. These details describe the catalog’s additions, not confirmed attacks against every user of those products.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 review
AI’s Role Is Not Measured
The material does not establish that AI caused the October increase in CVE publications, the rise in KEV additions or the Binance theft. It describes AI-linked security research and patching, and presents the claim that attackers can use AI to turn fixes into exploits quickly as Meyer’s assessment. The scale of any such effect is not quantified in the supplied figures.
The review’s counts also depend on definitions and methods. Its NVD total excludes rejected records, while another count including them is higher. The figures do not give a complete account of vulnerabilities that were exploited but not yet added to KEV, or of attacks that did not involve a publicly cataloged flaw. CertiK’s loss estimate and the stated share attributed to Binance are also source-reported figures; the material does not provide a detailed accounting of how the final amounts were calculated.
For the Binance incident, the source reports the FBI attribution to North Korea’s TraderTraitor and says the theft began with a compromised laptop. The supplied material does not describe the full investigative evidence, how access was obtained, or whether all stolen funds were recovered. Those details remain unresolved here.
Further Evidence and Patch Tracking
The next useful indicators are later updates to the NVD and CISA KEV catalog, which could change the October totals or add evidence about newly exploited flaws. Security teams will also be watching whether vulnerabilities associated with the month’s disclosures receive patches and whether credible reports show them being used in attacks. The review does not identify a specific forthcoming release or investigation milestone.
Further reporting on the Binance theft could clarify the amount ultimately lost, any recovery of funds and the basis for the FBI’s attribution. On AI, the available examples show research activity and claimed potential for faster exploit development, but a stronger assessment would require documented cases linking AI use to specific attacks or measurable changes in time from disclosure to exploitation.
Key Questions
How many CVE records were published in October 2026?
The review counted 17,060 new NVD records by publication date, excluding rejected records. It says a count including rejected records would be 17,481.
Did exploited vulnerabilities increase at the same rate as CVE disclosures?
No. The review reports 36 October additions to CISA’s KEV catalog, compared with 31 a year earlier, while its NVD count rose from 4,273 to 17,060. Those datasets track different things: published records versus vulnerabilities with evidence of exploitation.
Did AI cause the reported Binance theft?
The supplied material does not say that. It reports that the FBI attributed the theft to North Korea’s “TraderTraitor” and says the incident began with a compromised laptop. It does not link the theft to an AI-discovered vulnerability.
What does the review say AI contributed to in October?
It identifies security-release entries credited to AI models or AI vulnerability research firms and says OpenAI’s Patch the Planet program produced research behind PHP flaws patched on October 21. These examples show AI-linked research activity, but the review does not quantify AI’s overall effect on attack rates.
Source: ThorstenMeyerAI.com
