🔍 Read the full analysis: AI In The Cybersecurity Fight: Black October 2026, Episode One on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis of October 2026 reports record numbers of published CVEs and losses from crypto theft, alongside a smaller rise in vulnerabilities added to CISA’s exploited-flaws catalog. The source documents AI involvement in some vulnerability research and says attackers used AI to adapt fixes into exploits, but the figures do not show that AI caused the month’s broader surge or the Binance theft.
October 2026 brought record CVE disclosures and an extraordinary reported crypto-loss total, while the number of flaws added to the U.S. government’s list of vulnerabilities known to be exploited rose much less sharply. In a November 1 report, Thorsten Meyer argues that AI is speeding parts of the cybersecurity contest, but the figures he presents do not establish that AI caused the month’s records.
Meyer says his count of National Vulnerability Database (NVD) records, queried through the NVD API by publication date and excluding rejected entries, found 17,060 new CVEs in October. That compares with 4,273 in October 2025 and 3,564 in October 2024. From January through October 2026, he counted 89,859 records, against 39,639 over the same period in 2025. These are disclosures, not a count of attacks or proof that each flaw is being exploited.
The exploitation figures rose more moderately. The CISA Known Exploited Vulnerabilities catalog had 36 additions in October, compared with 31 in October 2025 and 17 in October 2024. Its 282 additions through October 2026 already exceeded the 245 added during all of 2025. Meyer notes that five October additions were older CVEs, from 2015 to 2023, for which new exploitation evidence had emerged. The catalog is a measure of known exploited flaws, not every attack.
For crypto losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. He says the Binance incident accounted for 96.7% of that month’s total. The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31, according to the source report. That attribution concerns the theft; the report does not link it to an AI-discovered vulnerability.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Surged Faster Than Exploitation
The gap between disclosure and documented exploitation changes how to read a record CVE month. More published vulnerabilities do not automatically mean more successful attacks: disclosures can rise because researchers and automated processes identify or assign more flaws. Meyer cites Google’s Threat Intelligence Group (GTIG), which said exploitation had risen roughly in step with disclosure over its analysis period and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The report’s October counts show a much larger jump in CVEs than in CISA additions, though the two datasets measure different things.
For defenders, the practical point is to distinguish a large disclosure queue from evidence of active abuse. CISA’s list offers one signal for prioritization, while the report also names affected internet-facing products such as remote-access gateways, firewalls and support tools. That does not mean every listed product was compromised in October; it indicates why organizations should check whether they use affected software and follow vendor guidance.
The AI evidence is relevant but limited. Meyer says Microsoft’s October security release credited an AI model or AI vulnerability research firm in at least 65 entries, including a flaw already exploited in the wild. He also says AI-assisted research found flaws that were patched. Those examples support a role for AI in vulnerability discovery and response, but they do not show that AI generated the record CVE count or drove the Binance incident.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames October through three separate measures: disclosed flaws, known exploitation and reported crypto theft. A CVE is a public identifier and record for a vulnerability; it does not by itself establish severity, exploitation or impact. CISA’s Known Exploited Vulnerabilities catalog is narrower, listing flaws for which the agency says there is reliable evidence of exploitation. Crypto-loss estimates track another kind of event and are not directly comparable with either vulnerability count.
The NVD totals depend on the method used. Meyer counted records by publication date and excluded rejected records; he says including rejected records would put October 2026 at 17,481. He also cautions that CVE identifiers themselves are not a valid way to count published flaws, because numbering authorities can reserve blocks. GTIG, according to Meyer, has warned that automated assignment policies can inflate totals: descriptions mentioning the Linux kernel alone generated about 5,000 CVEs from January to August 2026, with no zero-day exploitation observed for that group.
The report also describes AI-linked security work. Meyer says the PHP flaws known as PHP2Shell were patched on October 21 and came from OpenAI’s Patch the Planet program. He reports that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These are examples of research and remediation, not evidence that AI independently discovered every October flaw or that all such findings were exploited.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 report
AI’s Role Is Not Yet Quantified
The source presents a mix of counts, third-party assessments and Meyer’s interpretation. It does not establish how much AI contributed to the October CVE increase, how many attacks used AI, or whether AI caused a measurable rise in successful exploitation. Meyer’s prediction that attackers will use language models to turn fixes into exploits within days is presented as a view, not as a quantified finding.
The report says the PHP2Shell embargo broke before release and that attackers use AI to adapt fixes into exploits, but the supplied material gives no detailed incident timeline or independent evidence to quantify that activity. It also says zero-days averaged 11 a month, up from eight, without providing the underlying period or a full methodology in the material provided. Those figures should not be read as proof of a specific October trend without that context.
The Binance attribution is also distinct from the AI thesis. The FBI attribution to North Korea’s TraderTraitor is reported by Meyer, but the supplied material does not describe the evidence behind it or the theft’s technical method. It says the incident began with a compromised laptop, rather than an AI-found bug; further details on the compromise and recovery status are not supplied. CertiK’s net-loss estimate is an attributed figure, not an independently verified total in this report.
Track Exploitation and Incident Evidence
The next useful comparison will be whether subsequent CISA catalog additions and threat-intelligence reporting show exploitation rising alongside the much larger disclosure count. Readers and security teams can also look for vendor advisories and patches for the products named in the October catalog entries, while checking whether their own systems are affected. Disclosure totals alone cannot answer that question.
Further reporting would be needed to test Meyer’s AI thesis: documented cases should specify what AI did, when it was used, and whether it changed the speed or success of an attack or defense. Details about the Binance theft, including the compromise route and the basis for the FBI attribution, would help clarify that incident separately. The source links to a five-minute video, “Black October 2026, Episode One,” with animated charts; it says the narration uses an AI voice clone of Meyer and the images are AI-generated.
Key Questions
What happened in October 2026?
Meyer’s report says the NVD published 17,060 new CVE records that month, while CISA added 36 flaws to its Known Exploited Vulnerabilities catalog. The report also cites CertiK’s estimate of $3.47 billion in net crypto losses, most of it attributed to the Binance theft.
Does the CVE record mean attacks increased fourfold?
No. The 17,060 October CVE records were about four times the 4,273 recorded in October 2025, according to Meyer’s count. CVE disclosures measure public vulnerability records; they do not directly measure attacks. CISA’s October additions rose from 31 to 36 over the same year-to-year comparison.
What evidence does the report give for AI’s role?
Meyer cites AI-linked credits in at least 65 entries in Microsoft’s October security release, OpenAI’s Patch the Planet program and Google’s Big Sleep research. These examples concern vulnerability discovery or defense. The report does not quantify AI’s contribution to the overall CVE surge or to the Binance theft.
Who did the FBI blame for the Binance theft?
According to Meyer’s report, the FBI attributed the theft to North Korea’s TraderTraitor on October 31. The supplied source does not detail the evidence or fully explain how the compromise occurred.
Source: ThorstenMeyerAI.com
