🔍 Read the full analysis: Black October 2026, Episode One: The Month’s CVEs, Crypto Heist And AI on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source’s October 2026 review reports 17,060 new CVE records and $3.47 billion in crypto losses, most attributed to a theft from Binance. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog, far fewer than the rise in disclosures; the review also documents AI-linked vulnerability research and patching. The figures and conclusions come from the source’s analysis and cited organizations, and do not establish that AI caused the month’s broader security activity.
A November 1 review of October 2026 cybersecurity data reports a record 17,060 CVE records published by the U.S. National Vulnerability Database and $3.47 billion in crypto losses, while CISA added 36 vulnerabilities to its list of flaws known to be exploited. The figures describe different measures: disclosures, observed exploitation and stolen funds. The review also points to AI-linked vulnerability research and patching, but does not show that AI caused the month’s broader increase in disclosures or theft.
Thorsten Meyer, writing on ThorstenMeyerAI.com, says he queried the NVD API on November 1, counting records by publication date and excluding rejected entries. On that basis, October’s 17,060 records were up from 4,273 in October 2025 and 3,564 in October 2024. From January through October, the review counts 89,859 records in 2026, compared with 39,639 in the same period of 2025. Including rejected records would raise October’s count to 17,481, the article says.
The exploitation figures rose much less sharply. According to the review’s reading of CISA’s Known Exploited Vulnerabilities catalog, CISA added 36 vulnerabilities in October, compared with 31 in October 2025 and 17 in October 2024. It says the 2026 year-to-date total reached 282 by October 30, above the 245 additions for all of 2025. Five October additions involved older flaws first published between 2015 and 2023.
CertiK’s figures, as cited by Meyer, put October crypto losses at $3.47 billion after frozen and returned funds, against $68 million in October 2025. The review says Binance accounted for 96.7% of the October total and reports that the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. These are attributed findings, not an independently established account in the source material.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Rose Faster Than Exploitation
The main takeaway is the gap between published flaws and confirmed use by attackers. A CVE record documents a vulnerability; it does not by itself show that attackers are exploiting it. CISA’s KEV catalog is narrower, recording vulnerabilities for which it has evidence of active exploitation. The reported jump in CVEs therefore cannot be read as a matching surge in successful attacks.
That distinction matters for organizations deciding where to direct limited security resources. The review highlights flaws in remote-access gateways, firewalls, support tools and widely used software, including products from Ivanti, Citrix, Palo Alto Networks, Fortinet, Cisco, Atlassian, GitLab and VMware. A KEV listing can help defenders prioritize patching, but the numbers alone do not establish which systems are exposed or how many incidents resulted.
The crypto losses point to a different risk. The review says one Binance incident made up nearly all reported October losses. That concentration means the monthly total is not a measure of typical losses across the sector. It also undercuts any simple account that links the month’s largest security event to AI-assisted vulnerability discovery: Meyer says the theft began with a compromised laptop, not an AI-found flaw.
Products Worth Considering
Bose SoundLink Max Bluetooth Speaker
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames the month through three separate measures: disclosed vulnerabilities, known exploitation and crypto theft. They capture different stages and kinds of activity. Disclosure counts depend on publication and assignment practices, while KEV additions require evidence of exploitation. Crypto-loss estimates, meanwhile, can change when assets are frozen or returned.
The review cites Google’s Threat Intelligence Group (GTIG), which said exploitation had risen roughly in step with disclosure and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The source also reports a modest rise in average monthly zero-days, from eight to 11. GTIG’s stated time window and method matter when comparing these figures with the NVD and CISA totals; they are not interchangeable datasets.
AI is part of the account, but the evidence is specific rather than proof of a broad causal shift. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability-research firm, including one flaw already exploited in the wild. The review says PHP flaws patched on October 21, referred to as PHP2Shell, came from OpenAI’s Patch the Planet program. It also cites Google’s report that its Big Sleep system found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. Those cases show reported AI involvement in research; they do not establish that AI drove October’s overall CVE count.
““Some of it supports my view. Some of it does not.””
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Totals Cannot Prove
The supplied material does not include independent verification of the NVD query, CertiK’s loss calculation or the FBI attribution of the Binance theft. The figures should therefore be read as reported by Meyer and attributed to the named sources. NVD totals also depend on counting choices: rejected records are excluded in the headline figure, and the source says automated assignment practices can inflate counts.
It is not clear from the material how many October CVEs led to successful intrusions, how many affected systems were exposed, or whether the reported losses include incidents beyond the cited Binance event under a consistent accounting method. The review gives no incident-level evidence that AI caused the CVE surge, the Binance theft or a broad rise in attacks. Its claim that attackers can use AI to turn fixes into exploits within days is presented as a thesis, not a month-wide measurement.
Watch Exploitation and Attribution Updates
Readers can track whether the reported trends persist by comparing later NVD publication counts with additions to CISA’s KEV catalog, while keeping the datasets and time periods separate. Further updates to the Binance theft investigation and the FBI’s attribution could clarify the incident’s scope and the basis for the reported losses.
For the AI claims, the next useful evidence would be published case details showing what a tool found, when the flaw was reported, when a patch became available and whether attackers exploited it. Meyer’s review says the PHP flaws were patched on October 21 and notes that the embargo broke before release, but the supplied material does not give a full timeline or explain the breach. The review’s five-minute video, published alongside the article, presents its three ledgers and AI cases; it does not settle the open questions.
Key Questions
How many CVEs were published in October 2026?
Meyer reports 17,060 NVD records published that month, excluding rejected records. He says the count would be 17,481 if rejected records were included.
Does a record number of CVEs mean a record number of attacks?
No. A CVE records a disclosed vulnerability, while CISA’s KEV catalog tracks flaws with evidence of active exploitation. The review reports 36 KEV additions for October, compared with 17,060 CVE records; those figures measure different things.
What does the review say about the Binance theft?
It cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds, and says Binance accounted for 96.7% of that total. Meyer reports that the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31.
Did AI cause the October security records?
The source does not establish that. It documents AI-linked research and patching, including Microsoft security entries and PHP flaws attributed to OpenAI’s Patch the Planet program, but says the scale of AI’s role in the wider CVE increase and attacks remains unproven.
Source: ThorstenMeyerAI.com
