🔍 Read the full analysis: Black October 2026, Episode One: How AI Entered The Cybersecurity Battle on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 saw a record 17,060 new CVE records and $3.47 billion in reported crypto losses, according to the supplied source. The evidence for AI’s role is mixed: AI-linked research found flaws that were patched, while attackers used AI to help turn some fixes into exploits; most disclosed vulnerabilities were not observed being exploited.
October 2026 set records for disclosed vulnerabilities and reported cryptocurrency losses, while documented cases showed AI tools contributing to security research and exploit development, according to a November 1 analysis by Thorsten Meyer. The evidence does not show that the disclosure surge translated into a comparable rise in exploitation: the report says only about one in 431 vulnerabilities disclosed in 2026 had been seen exploited.
The analysis says the U.S. National Vulnerability Database published 17,060 new CVE records in October, compared with 4,273 in October 2025. Meyer says his count used the NVD API, grouped records by publication date and excluded rejected records. From January through October, the total was 89,859, against 39,639 over the same months in 2025. Counts vary by method: including rejected records would put October’s total at 17,481, according to the report.
A different measure, the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, rose less sharply. CISA added 36 vulnerabilities in October, compared with 31 in October 2025 and 17 in October 2024. The report says 282 had been added in 2026 through October, already above the 245 additions recorded in all of 2025. KEV entries identify flaws for which CISA cites evidence of exploitation; they are not a count of every attack.
The article also reports $3.47 billion in October crypto losses, after frozen and returned funds, citing security firm CertiK. It says the Binance theft accounted for 96.7% of that amount and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The source describes the event as a record theft, but the material supplied here does not include the FBI statement or independent documentation for that characterization.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
AI’s Role in Finding and Using Flaws
The month’s figures matter because they measure different parts of the security picture. CVE publication tracks disclosed flaws; CISA’s KEV catalog tracks vulnerabilities with evidence of real-world exploitation; crypto-loss estimates track a separate category of criminal activity. Treating them as interchangeable could make a disclosure spike look like an equivalent rise in attacks when the available data does not support that conclusion.
The analysis points to evidence of AI’s influence on both sides of the process. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability-research firm, including a flaw already exploited in the wild. It also says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples indicate that AI can assist researchers in finding vulnerabilities; they do not establish how much of the month’s overall CVE increase AI caused.
On the attacker side, the report says AI helped turn fixes into exploits within days and points to an embargo on the PHP2Shell vulnerabilities breaking before their October 21 patch release. That timing could narrow the window defenders have to update systems. But the source also says the Binance theft began with a compromised laptop, rather than an AI-discovered flaw. The evidence supports a more complicated account than an AI-driven attack wave, and crypto losses cannot by themselves show that AI played a role.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer’s analysis separates October’s activity into three measures: published CVEs, CISA KEV additions and reported crypto losses. A CVE is a public record describing a vulnerability; a larger count can reflect more flaws being found or more records being filed. A KEV entry is narrower, requiring evidence that attackers have exploited a flaw. Crypto losses are a separate measure and do not directly track software vulnerabilities.
The source says Google’s Threat Intelligence Group reported that exploitation had risen roughly in step with disclosure and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. It also cites a moderate rise in monthly zero-day counts, from an average of eight to 11. Separately, the report warns that automated assignment policies can inflate CVE totals: it says descriptions mentioning the Linux kernel alone produced about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation. These points complicate any attempt to read the record CVE count as a direct measure of attacker activity.
For the October AI examples, the report identifies PHP2Shell as emerging from OpenAI’s Patch the Planet program and says the flaws were patched on October 21. It also cites Microsoft’s security-release credits and Google’s Big Sleep results. The material supplied does not include technical advisories, study methods or independent assessments for those examples, so their details should be treated as claims made in the analysis.
What the October Data Cannot Prove
The source’s figures are a snapshot, and the measures have different definitions and collection methods. A CVE count is not an attack count, and a KEV addition records evidence of exploitation rather than every exploit in circulation. The report’s one-in-431 estimate also does not mean that all other vulnerabilities are safe; it describes what had been observed as exploited in the period covered.
It remains unclear how much AI contributed to October’s overall disclosure total, how often attackers used AI in successful intrusions, and whether AI materially accelerated the PHP2Shell exploit activity. The supplied material does not provide the underlying incident reports, technical evidence or complete methods for independently checking those claims. It also does not include the cited FBI attribution statement or a detailed account of the Binance incident. The connection between AI and the month’s largest financial loss is not established by the source.
Further Evidence Needed on AI Attacks
The next step is to compare future disclosures with evidence of exploitation, rather than treating record CVE totals as a proxy for attacks. Security agencies and researchers can add clarity by publishing case-level details on how vulnerabilities were discovered, whether AI was used, and when exploitation began. Patch timelines and technical analyses of the PHP2Shell flaws would also help establish what happened around the reported embargo breach.
For October’s financial losses, confirmation of the FBI attribution and further public reporting on the Binance incident would help separate the theft’s verified facts from the analysis’s interpretation. Until those details are available, the evidence supports a measured conclusion: AI appeared in documented security research and may have assisted exploit development, but the scale of its contribution to October’s attacks remains unresolved.
Key Questions
What was the main development reported about October 2026?
The analysis reported a record 17,060 new CVE records, 36 additions to CISA’s Known Exploited Vulnerabilities catalog and $3.47 billion in October crypto losses, according to the figures it cites. It also described cases in which AI contributed to vulnerability research and exploit development.
Does the record number of CVEs mean attacks rose fourfold?
No. The report says October’s CVE count was about four times the October 2025 total, but CVEs measure published vulnerability records, not attacks. CISA added 36 flaws to its KEV catalog in October 2026, compared with 31 in October 2025.
What role did AI reportedly play?
The analysis says AI models or AI vulnerability-research firms were credited in at least 65 Microsoft security-release entries, and that Google’s Big Sleep found actionable Chrome JavaScript-engine bugs. It also says attackers used AI to help turn fixes into exploits, but the source does not establish the overall scale of AI use in attacks.
Was the Binance theft linked to AI?
The supplied source says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31 and says the incident began with a compromised laptop. It does not establish that AI caused or enabled the theft, and the underlying FBI statement is not included in the source material.
What remains uncertain?
The amount of the CVE surge caused by AI, the frequency with which attackers used AI successfully, and AI’s role in particular incidents remain unclear. The source also does not provide enough underlying documentation to independently verify all the cited claims.
Source: ThorstenMeyerAI.com
