🔍 Read the full analysis: Black October 2026, Episode One: Record CVEs, A $6 Billion Crypto Heist And AI On Both Sides Of The Fight on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis reports 17,060 CVE records published in October 2026 and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. It also cites CertiK’s estimate of $3.47 billion in net crypto losses and the FBI’s attribution of the Binance theft to North Korea; the article argues that disclosure, exploitation and theft are separate measures, and that its AI-related findings do not establish AI as the cause of the month’s records or losses.
The author reports that the U.S. National Vulnerability Database published 17,060 new CVE records in October, compared with 4,273 in October 2025. The count excludes records marked rejected and is based on a query of the NVD API on November 1. Including rejected records would put October 2026’s total at 17,481, according to the analysis. From January through October, the author counted 89,859 records, against 39,639 in the same period of 2025.
A different measure rose more slowly. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, versus 31 in October 2025 and 17 in October 2024. The author says the 2026 year-to-date total reached 282, surpassing the 245 additions recorded during all of 2025. KEV entries require evidence of exploitation; CVE publication records the existence of a vulnerability and does not by itself show attackers have used it.
For cryptocurrency, the analysis cites CertiK’s estimate of $3.47 billion in October losses after frozen or returned funds were accounted for, compared with $68 million in October 2025. It says the Binance incident made up 96.7% of October’s total. The FBI attributed the theft to North Korea’s TraderTraitor on October 31. The source describes more than $6 billion leaving Binance in one evening, but does not provide enough detail here to reconcile that figure with CertiK’s net-loss estimate.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Surged Faster Than Exploitation
The figures matter because they describe different stages of security risk, not one interchangeable tally. CVE records track disclosures; CISA’s KEV catalog tracks vulnerabilities for which exploitation is known; crypto-loss estimates measure reported financial harm. October’s sharp rise in disclosures therefore cannot, by itself, show that attacks increased at the same rate.
The author cites Google’s threat intelligence group as finding that roughly one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The source also says zero-day exploitation rose moderately, from an average of eight to 11 per month. Those comparisons temper the headline figures, although they do not mean that organizations can ignore the vulnerabilities appearing in public records.
For defenders, the practical issue is prioritization: a very large disclosure count can make it harder to identify the flaws with evidence of active abuse. The month’s KEV additions included products used at network boundaries and for remote access, according to the analysis. Separately, the Binance incident shows the scale of reported crypto losses, but the source says the theft began with a compromised laptop—not an AI-found vulnerability. The two developments should not be treated as evidence of one common cause.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Black
Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
Three Measures, Three Different Signals
The analysis separates the month into disclosed, exploited and stolen categories. A CVE is a public identifier and record for a vulnerability. The NVD publishes CVE information, while CISA’s KEV catalog identifies flaws for which it has evidence of active exploitation. Crypto-loss totals rely on incident and transaction assessments, which can change when funds are frozen or returned.
Counting choices affect the CVE totals. The author excluded rejected NVD records and counted by publication date; including rejected entries produces a higher figure. The analysis also cautions that CVE totals can be affected by assignment practices. It cites Google’s threat intelligence group, which said that Linux-kernel descriptions alone accounted for about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation among those cases.
The source also reports AI-related work during October. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It attributes the PHP2Shell findings, patched on October 21, to OpenAI’s Patch the Planet program. It further says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These are specific reported examples, not evidence that AI caused October’s overall CVE increase.
“The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on 31 October.”
— The FBI, as reported by Meyer
Counts Do Not Settle Causation
The source is a single author’s analysis, and its counts depend on stated methods and data sources. It does not include the underlying incident records or a full reconciliation of the reported more than $6 billion leaving Binance and CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds. The difference may reflect distinct measures, but the supplied material does not explain it.
It is also unclear from the source how much of the CVE rise resulted from changes in disclosure or numbering practices, rather than a rise in newly discovered flaws. The author notes that automated assignment can affect totals and that CVE volume is not a measure of exploitation. The article’s claim that AI findings were made and fixes shipped during the month is based on cited product and research examples; it does not establish AI as the cause of the record CVE count.
The source argues that attackers can use AI to turn fixes into exploits within days and says an embargo around PHP2Shell broke before release. It provides no detailed evidence in the supplied text to quantify how often that happened or how much AI contributed. The broader claim about a coming period of increased AI-assisted attacks is explicitly the author’s view, not a measured forecast.
Watch Exploitation and Patch Evidence
The next useful checks are whether CISA adds further October-related vulnerabilities to KEV, whether agencies and affected vendors publish additional details on exploitation, and whether follow-up reporting clarifies the Binance loss estimates. The analysis says its KEV snapshot was dated October 30, so later catalog updates could change the month’s tally.
Readers should also watch for fuller documentation of the AI-linked findings: which vulnerabilities were discovered with AI assistance, when they were reported, and when patches became available. Those details would help distinguish AI’s role in research and remediation from claims about AI-assisted exploitation.
For now, the reported data support a clear but limited conclusion: October had an exceptional number of published CVEs and a high reported crypto-loss estimate, while CISA’s monthly KEV additions rose much less sharply than CVE publications. Whether AI is driving a sustained change in attacker behavior remains unresolved by the figures presented.
Key Questions
How many CVEs were published in October 2026?
The analysis counted 17,060 NVD records published in October, excluding rejected records. It says the total would be 17,481 if rejected records were included.
Does the CVE record mean those flaws were exploited?
No. A CVE record documents a vulnerability; it does not establish that attackers used it. CISA’s KEV catalog is a separate list for vulnerabilities with evidence of known exploitation.
What did the source report about the Binance theft?
It says more than $6 billion left Binance in one evening on October 29 and reports that the FBI attributed the theft to North Korea’s TraderTraitor on October 31. It also cites CertiK’s separate October net-loss estimate of $3.47 billion after frozen and returned funds; the supplied material does not reconcile the figures.
Did AI cause October’s record CVE count or the Binance theft?
The source does not establish either claim. It reports AI-linked vulnerability research and fixes, while saying the Binance theft began with a compromised laptop rather than an AI-found flaw. The author’s wider prediction about AI-assisted attacks is presented as an opinion, not a measured result.
Source: ThorstenMeyerAI.com
