🔍 Read the full analysis: Black October 2026: How AI Appeared On Both Sides Of The Fight on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
The source’s October 2026 review reports 17,060 new NVD vulnerability records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. It also describes AI-assisted vulnerability research that led to fixes, while stressing that disclosure counts do not equal attacks and that the cause of the month’s record crypto losses was not an AI-found flaw.
A November 1 review of October 2026 security data reports a record 17,060 new vulnerability records in the U.S. National Vulnerability Database, alongside 36 additions to the government’s list of flaws known to be exploited. The review also documents AI-assisted vulnerability research that led to fixes, but its figures do not establish that AI caused a broad rise in attacks: disclosures grew far faster than entries on the exploited-flaw list.
Thorsten Meyer, writing on ThorstenMeyerAI.com, says he queried the NVD API on November 1, counting records by publication date and excluding rejected entries. On that basis, October’s 17,060 records were four times the 4,273 recorded in October 2025. For January through October, the tally was 89,859 in 2026, compared with 39,639 in the same period of 2025. The count depends on methodology: including rejected records would put October at 17,481, Meyer says.
A separate measure points to a more limited rise in known exploitation. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, against 31 in October 2025 and 17 in October 2024. The catalog’s additions reached 282 for January through October 2026, above the 245 recorded across all of 2025. Those figures measure catalog additions, not every attack or every exploited vulnerability.
The review identifies examples of AI’s role in vulnerability research and remediation. It says at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. Meyer also says the PHP2Shell flaws were found through OpenAI’s Patch the Planet program and patched on October 21. Google’s Big Sleep, the article reports, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Disclosure Counts Outpaced Exploitation
The figures matter because a surge in published flaws can put pressure on security teams, but it does not by itself show that attackers are exploiting vulnerabilities at the same rate. In Meyer’s accounting, October’s CVE disclosures quadrupled year over year, while additions to CISA’s exploited-flaw catalog rose from 31 to 36. That gap cautions against treating a record in vulnerability reporting as a record in successful attacks.
There is still a practical concern: a public fix can give attackers information they may use to develop exploits. Meyer argues that attackers can use AI to turn fixes into exploits within days, and says PHP2Shell’s embargo ended before its planned release. These are the article’s assessments and examples, not proof that AI has broadly accelerated exploitation. The distinction matters to organizations deciding how quickly to prioritize patches: the data support attention to documented exploitation, but do not show that every newly disclosed issue poses the same immediate risk.
The review also separates vulnerability activity from financial losses. CertiK’s reported estimate for October crypto losses was $3.47 billion after frozen and returned funds, compared with $68 million in October 2025. The source says Binance accounted for 96.7% of the October total. That concentration makes the headline figure unusually dependent on one incident rather than evidence of a general increase across all security breaches.
Products Worth Considering
Jackery Solar Generator 1000 v2 with 200W Solar Panel
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Security Signals
Meyer frames the review around three separate measures: disclosed vulnerabilities, known exploitation, and reported crypto losses. A CVE is a public record that a vulnerability exists; its publication does not mean attackers have used it. CISA’s KEV catalog, by contrast, lists vulnerabilities for which the agency has reliable evidence of active exploitation. Crypto-loss estimates track a different outcome and should not be read as a count of software vulnerabilities or cyberattacks.
The NVD totals also reflect the way records are assigned and published. Meyer cites Google Threat Intelligence Group’s observation that automated assignment policies can inflate CVE counts. The group said descriptions mentioning the Linux kernel generated about 5,000 CVEs from January through August 2026, with zero observed zero-day exploitation in that set. That example shows why raw disclosure totals need context about who is assigning records and what the records represent.
The source further cites Google’s September 30 account of exploitation trends: it counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, more than the 127 it counted across all of 2025. It also says the average rose from 10.5 a month in 2025 to 18 a month in 2026. Those figures cover a different period and method from October’s CISA additions, so they are related evidence rather than directly interchangeable totals.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Figures Cannot Show
The source material does not establish that AI caused the rise in vulnerability disclosures, the increase in CISA catalog additions, or the reported crypto losses. It describes AI-assisted discovery and patching in specific cases, but offers no comparison showing how many flaws would have been found or fixed without AI. Nor does a count of published records measure how many unique, exploitable weaknesses are present across deployed systems.
The cause and full details of the Binance incident also need careful attribution. Meyer says more than $6 billion left Binance on October 29 and reports that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The review says the incident began with a compromised laptop, not an AI-found vulnerability. The provided material does not include the FBI’s underlying evidence, a detailed incident account, or a clear reconciliation between the reported outflow and CertiK’s net-loss estimate of $3.47 billion after frozen and returned funds.
Some information in the supplied source is incomplete, including its discussion of threat-intelligence figures and the reported speed with which attackers can turn fixes into exploits. The size and representativeness of the AI-linked cases, the effect of October’s disclosure surge on real-world attacks, and the final accounting of crypto losses remain unsettled in the material provided.
Tracking Exploitation and Patch Outcomes
The next useful test is whether vulnerabilities disclosed in October appear in CISA’s KEV catalog or in other documented exploitation reports, and how quickly affected vendors and users apply available fixes. That would help distinguish a temporary rise in reporting from an increase in flaws being used against organizations. The figures should be compared using the same time windows and counting methods.
Further reporting on the Binance incident may clarify the attack path, the amount ultimately lost, and the basis for the FBI’s attribution. For the AI examples, more detail on the number of bugs found, their severity, patch timelines, and independent verification would show how much practical change AI-assisted research has made. Until those details are available, October’s records point to heightened disclosure and documented AI involvement, but not a settled conclusion that AI drove a general surge in attacks.
Key Questions
What happened in October 2026?
A review published November 1 reports 17,060 new NVD records for the month, 36 additions to CISA’s Known Exploited Vulnerabilities catalog, and examples of AI-assisted vulnerability discovery that led to fixes.
Does the record number of CVEs mean attacks quadrupled?
No. The reported fourfold increase compares October 2026 NVD records with October 2025. A CVE record documents a vulnerability; it does not show that attackers exploited it. CISA’s catalog additions rose from 31 to 36 over the same October comparison.
How was AI involved in vulnerability research?
The source says AI models or AI vulnerability research firms were credited in at least 65 Microsoft security-release entries. It also attributes the PHP2Shell findings to OpenAI’s Patch the Planet program and reports that Google’s Big Sleep found actionable Chrome JavaScript-engine bugs during a six-month comparison with Google’s fuzzer.
What does the source say about the Binance theft?
Meyer reports that more than $6 billion left Binance on October 29 and says the FBI attributed the theft to North Korea’s TraderTraitor on October 31. The article says the incident began with a compromised laptop, not an AI-found bug. The supplied material does not provide the underlying attribution evidence or a full reconciliation of loss estimates.
Source: ThorstenMeyerAI.com
