🔍 Read the full analysis: Black October 2026, Episode One: Record CVEs, A $6 Billion Crypto Heist And AI On Both Sides on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 report by Thorsten Meyer says October 2026 set a monthly record for published CVEs and saw a record crypto-loss total, driven largely by a reported Binance theft. It also records a smaller rise in CISA’s exploited-vulnerability list and describes AI-assisted vulnerability research, while stressing that the disclosure surge does not show a comparable rise in exploitation.
Meyer says his count of the U.S. National Vulnerability Database’s published, non-rejected records found 17,060 new CVEs in October, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the report counted 89,859 records in 2026, against 39,639 in the same period of 2025. Meyer says the figures came from an NVD API query conducted on the morning of November 1; including rejected records would raise October 2026’s count to 17,481.
The exploitation figures rose much less sharply. CISA added 36 vulnerabilities to its KEV catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog had 282 additions from January through October 2026, exceeding the 245 additions recorded for all of 2025. The report cautions that a KEV listing reflects evidence of exploitation, while a CVE record only documents a vulnerability.
On crypto losses, the report cites CertiK’s total of $3.47 billion for October, after frozen and returned funds were deducted, compared with $68 million in October 2025. It says Binance accounted for 96.7% of that month’s total. The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31, according to Meyer’s account.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why CVE Counts Do Not Equal Attacks
The figures describe separate parts of the security picture. A surge in published CVEs can give defenders more issues to assess and patch, but it does not establish that attackers exploited the same number of flaws. Meyer’s comparison shows disclosures grew far faster than CISA’s KEV additions; the report says only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited, citing Google’s threat intelligence group.
The distinction matters for organizations deciding how to prioritize security work. A long disclosure list is not, by itself, a measure of active attacks. KEV entries provide a narrower signal of known exploitation, while the crypto-loss figure reflects financial losses attributed to incidents and is subject to the source’s accounting method. The report’s large Binance figure also means its monthly total was concentrated in one incident rather than spread evenly across many thefts.
Meyer argues that AI may help researchers find vulnerabilities and attackers turn public fixes into working exploits. The material he presents offers examples of AI involvement, but it does not establish that AI caused October’s overall disclosure record or the Binance theft. He describes the claim that the month marks a new phase of AI-driven attacks as his thesis, not as a measured conclusion.
Popular right now
LG 85-Inch QNED73B Mini LED 4K Smart TV (2026)
Jura E6 Automatic Espresso Machine, Piano Black (15622)
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
Three Different Security Ledgers
Meyer organizes the report around three measures: vulnerabilities disclosed through CVE records, vulnerabilities listed as exploited by CISA, and cryptocurrency funds reported stolen. Each measure answers a different question. CVE volume tracks public records; KEV additions track flaws with evidence of active exploitation; crypto-loss totals track financial impact as reported by CertiK.
The report notes that CVE totals depend on counting methods and reporting practices. It cites Google’s threat intelligence group as saying automated assignment policies can increase totals. For example, Meyer says GTIG found about 5,000 CVEs mentioning the Linux kernel from January through August 2026, with no observed zero-day exploitation among those entries. That example cautions against reading every record as a distinct, actively exploited threat.
On AI-related security work, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He also says PHP flaws known as PHP2Shell were patched on October 21 after emerging from OpenAI’s Patch the Planet program. Google’s Big Sleep, according to the report, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, report author
What the Numbers Cannot Show
The report does not establish why NVD records rose so sharply in October, how much of the increase reflects new vulnerabilities versus changes in submission or assignment practices, or whether the monthly total will be revised. Its CVE counts are Meyer’s query results, not a separately presented audit of the NVD data.
The supplied material does not give a full technical account of the Binance incident, the exact amount taken before recoveries, or evidence explaining how the attackers gained access. It reports the FBI’s attribution to North Korea’s “TraderTraitor,” but does not include the FBI’s statement itself. The claim that the theft began with a compromised laptop appears in Meyer’s discussion; the material does not provide supporting technical details.
Nor does the report quantify how much AI contributed to finding or exploiting vulnerabilities across the month. The cited examples indicate AI involvement in particular research and disclosure cases, while the broader claim that AI is accelerating attacks remains Meyer’s assessment. His comparison of exploitation and disclosure also cites GTIG figures, but the report excerpt does not provide the full methodology behind every figure.
Follow-Up Data and Incident Details
The next useful checks are updates to the underlying records: NVD publication totals, later additions to CISA’s KEV catalog, and any revisions to CertiK’s October loss estimate after recoveries or frozen funds are accounted for. Those updates could change the month’s totals, though the report does not identify a scheduled release or a specific follow-up date.
Further reporting from the FBI, Binance, or investigators would be needed to clarify the theft’s mechanics and the evidence supporting the attribution. For the AI claims, incident-level details about which tools were used, what flaws they found, and how quickly attackers exploited patches would help distinguish documented cases from the report’s wider thesis.
Until those details are available, October’s figures support a precise but limited conclusion: public vulnerability records rose dramatically, known exploited-vulnerability additions increased more modestly, and the reported crypto-loss total was dominated by the Binance incident. They do not, on their own, show that exploitation rose at the same rate as disclosure or that AI caused the month’s largest security events.
Key Questions
What security records did October 2026 set, according to the report?
Meyer’s report says October set a record for monthly NVD CVE publications and that CertiK counted a record $3.47 billion in crypto losses after frozen and returned funds. CISA added 36 vulnerabilities to its KEV catalog; the report describes that as an increase, but not a record for the month.
How many CVEs were published in October 2026?
The report’s NVD API count is 17,060 published, non-rejected records. Meyer says the count would be 17,481 if rejected records were included.
Does the CVE record mean attacks increased by the same amount?
No. A CVE record shows that a vulnerability was publicly recorded; it does not prove exploitation. CISA added 36 vulnerabilities to its KEV catalog in October, while the report says CVE disclosures rose much faster.
Who did the FBI blame for the Binance theft?
According to Meyer’s report, the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The supplied material does not include further details about the FBI’s evidence or the incident’s mechanics.
What evidence links AI to October’s security activity?
The report cites Microsoft security entries crediting AI models or AI vulnerability research firms, OpenAI’s Patch the Planet program and Google’s Big Sleep research. These examples do not establish that AI caused the CVE surge or the Binance theft.
Source: ThorstenMeyerAI.com
