🔍 Read the full analysis: Why AI Matters In Black October 2026’S Cybersecurity Story on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 brought a sharp increase in published vulnerability records, more additions to CISA’s exploited-flaw catalog, and reported crypto losses of $3.47 billion. The source credits AI tools with finding some vulnerabilities and says attackers can use AI to turn fixes into exploits quickly, but the figures do not show that AI caused the month’s broader rise in disclosures or attacks.
October 2026 set records for newly published vulnerability records and reported crypto losses, while the number of flaws added to the U.S. government’s exploited-vulnerability catalog rose at a far slower rate. In an analysis published November 1, Thorsten Meyer argues that artificial intelligence helped identify some serious software flaws, but the figures do not establish that AI drove the month’s wider cybersecurity surge.
Meyer’s count of the National Vulnerability Database (NVD), based on records published in October and excluding rejected entries, found 17,060 new CVE records. That is four times the 4,273 recorded in October 2025. From January through October, the count was 89,859, compared with 39,639 in the same period last year. The analysis says the October figure would be 17,481 if rejected records were included, underscoring that totals depend on counting method.
A separate measure, the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, had 36 additions in October, up from 31 in October 2025. CISA’s catalog lists flaws for which there is evidence of active exploitation; it is not a count of every vulnerability or attack. The analysis reports 282 additions from January through October 2026, already above the 245 added during all of 2025. It also cites Google’s threat intelligence group as saying exploitation has risen roughly alongside disclosure over a longer period, with about one in 431 vulnerabilities disclosed in 2026 observed exploited.
Crypto losses offered a third, distinct measure. Citing CertiK, Meyer reports $3.47 billion in October losses after accounting for funds frozen and returned, compared with $68 million in October 2025. The analysis says the Binance theft accounted for 96.7% of the month’s total. On October 31, the FBI attributed that theft to North Korea’s TraderTraitor group. These figures track reported financial losses, not software flaws or the number of cyberattacks.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Three Measures, Different Risks
The numbers matter because they describe different parts of the security picture. A surge in published CVEs can mean that more flaws are being found or recorded; by itself, it does not show that attackers exploited them. CISA’s KEV additions provide a narrower measure of flaws with evidence of real-world use, while crypto-loss estimates capture financial impact. Treating all three as one “record for hacks” would obscure what the data can and cannot show.
The gap is especially relevant for security teams managing limited time. Meyer reports that October’s KEV additions rose 16% from a year earlier even as published CVEs quadrupled. That does not make the larger disclosure count irrelevant: defenders still need to identify whether affected products are in use and apply available fixes. But the gap cautions against equating every newly published record with an active threat. The analysis also notes that CISA’s October list included flaws in remote-access gateways, security appliances, collaboration tools and other widely used software.
AI adds a second question: whether it is changing how quickly flaws are found and exploited. The source documents AI involvement in vulnerability research and describes attackers using AI to turn fixes into exploits within days. That possibility matters because faster conversion from disclosure to attack can reduce the time defenders have to patch. Yet the month’s largest reported theft, according to the analysis, began with a compromised laptop rather than an AI-found software flaw. The evidence supports watching AI’s role, not treating it as a proven explanation for every October record.
Products Worth Considering
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How October’s Ledgers Were Counted
The analysis separates three ledgers: disclosed flaws, flaws with evidence of exploitation, and reported crypto losses. Meyer says the NVD figures came from an API query made on the morning of November 1, counting records by publication date and excluding rejected records. CVE records are public identifiers and descriptions of vulnerabilities; their total is not a direct measure of the number of attacks. The source also warns that automated assignment practices can raise counts. It cites Google’s threat intelligence group, which said descriptions mentioning the Linux kernel accounted for about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation among that set.
On AI-assisted research, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. The source links the PHP2Shell flaws, patched October 21, to OpenAI’s Patch the Planet program. It also reports that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show specific research contributions; they do not establish how much AI contributed to the overall CVE increase.
The analysis also places October in a longer trend. Google’s threat intelligence group, in findings cited by Meyer as published September 30, counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, more than the 127 it counted across all of 2025. The source gives an average of 18 such vulnerabilities per month in that 2026 period, compared with 10.5 per month in 2025. Those figures use a different time window and measure from the October NVD and CISA totals.
“That is my view, not a measurement.”
— Thorsten Meyer, describing his interpretation of the data
What the Figures Cannot Establish
The October counts do not establish that AI caused the rise in CVE records or the reported crypto losses. Meyer’s claim that attackers can use AI to turn fixes into exploits within days is presented as a conclusion from documented cases, but the supplied material does not give a full count of those incidents or quantify how frequently AI was used. It also says PHP2Shell’s embargo broke before release, without providing additional detail about the breach or its effects.
Some measures remain sensitive to definitions and timing. NVD totals vary depending on whether rejected records are included, and the source says automated assignment practices affect the number of CVEs. The KEV catalog records additions, not every exploit attempt or every vulnerability attackers use. Crypto-loss estimates can change when funds are frozen or returned; the source does not provide a separate breakdown of the Binance incident’s full investigative findings. The FBI attribution to TraderTraitor is an official assessment, not an independently detailed account in the supplied material.
The analysis states that zero-days rose moderately, from an average of eight to 11 a month, but the excerpt does not specify the full comparison period or counting method. It also does not establish whether the October patterns will continue. Its central thesis—that AI will contribute to more large-scale vulnerabilities and attacks—remains a forecast rather than a measured outcome.
What Defenders Should Track
The next useful test will be whether published vulnerabilities continue to translate into observed exploitation, and how quickly that happens after disclosure or a patch release. Security teams can track CISA KEV updates alongside vendor advisories and assess whether affected products are deployed in their own systems. The October totals make clear that disclosure volume alone is an insufficient guide to immediate risk.
Further reporting would also need to distinguish AI-assisted discovery from AI-assisted exploitation, with dated examples and comparable counts. The source identifies Microsoft security entries, PHP2Shell and Google’s Big Sleep as cases to examine, but it does not provide a common method for measuring their contribution. The November 1 analysis says it is testing its thesis against available data; whether subsequent months support that view remains open.
Key Questions
What cybersecurity records did October 2026 set?
The analysis reports 17,060 new NVD CVE records in October, excluding rejected records, and $3.47 billion in crypto losses after frozen and returned funds. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. These are different measures, not a single count of attacks.
Does the CVE surge mean attacks quadrupled?
No. The NVD record count was four times October 2025’s count, but that measures published vulnerability records, not attacks. CISA’s KEV catalog added 36 items in October 2026, compared with 31 a year earlier.
What evidence links AI to October’s vulnerabilities?
The source says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm. It also attributes the PHP2Shell flaws to OpenAI’s Patch the Planet program and cites Google’s Big Sleep research. These cases do not show that AI caused the overall increase in CVEs.
Who did the FBI say was responsible for the Binance theft?
The source reports that on October 31, the FBI attributed the theft to North Korea’s TraderTraitor group. The supplied material does not include further details of the investigation.
Source: ThorstenMeyerAI.com
