🔍 Read the full analysis: Why Record CVEs And A $6 Billion Heist Made AI Part Of Black October on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports that the National Vulnerability Database published 17,060 CVE records in October 2026, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. CertiK counted $3.47 billion in crypto losses after recoveries, most attributed to a Binance theft that the FBI linked to North Korea; the source says the incident began with a compromised laptop, not an AI-found vulnerability. AI tools and research programs also contributed to finding software flaws that were patched, but the evidence does not establish that AI caused October’s wider rise in vulnerabilities or theft.
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses after recoveries, according to figures compiled by Thorsten Meyer. But the number of flaws added to the U.S. government’s list of vulnerabilities known to be exploited rose far less sharply, while several software bugs were credited to AI-assisted research. The figures show a month of sharply different security measures, not proof that AI caused the disclosure surge or the major theft.
Meyer says he queried the National Vulnerability Database (NVD) API on the morning of November 1, counting records by publication date and excluding rejected entries. On that basis, the NVD published 17,060 records in October, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October 2026, his count was 89,859, against 39,639 in the same period of 2025. Including rejected records would put October’s total at 17,481, he says.
The U.S. Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog records flaws for which CISA says there is evidence of exploitation. Its 282 additions so far in 2026 exceed the 245 added during all of 2025. These totals are not directly interchangeable: CVE disclosures count published vulnerability records, while KEV additions represent flaws for which exploitation evidence has been identified.
On crypto losses, the source cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds, versus $68 million in October 2025. It says Binance accounted for 96.7% of the month’s total. The FBI attributed the Binance theft to North Korea’s TraderTraitor group on October 31, according to Meyer. Separately, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw that had already been exploited. The PHP flaws known as PHP2Shell were patched on October 21 and came from OpenAI’s Patch the Planet program, according to the source.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The central distinction is between how many flaws are disclosed and how many have evidence of real-world exploitation. October’s CVE total was about four times its October 2025 level, while CISA’s monthly KEV additions rose from 31 to 36. A larger disclosure count can reflect more reporting, automation, or research; it does not mean every listed flaw is being used against organizations.
For defenders, the KEV catalog and vulnerability details may offer a more immediate way to prioritize response than the raw number of CVEs. Meyer notes that October’s KEV additions included flaws affecting remote-access products, firewalls, software development platforms, virtualization systems, PHP, and Google’s Brotli compression library. That spread underscores the range of systems requiring attention, but the figures alone do not establish how many organizations were affected or how severe each case was.
The AI evidence matters for a different reason. AI-assisted research is being credited in vulnerability discovery and remediation, and Meyer argues that attackers can use AI to turn public fixes into exploits quickly. That is a risk assessment, not a quantified finding for all October incidents. The source’s account of the Binance theft points to a compromised laptop, rather than an AI-discovered software flaw, as its starting point. The month therefore supports discussion of AI’s changing role without showing that it explains the largest loss or the overall disclosure record.
Products Worth Considering
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Three Security Measures, Different Signals
Meyer frames the month through three separate measures: disclosed vulnerabilities, vulnerabilities with evidence of exploitation, and publicly visible crypto losses. A CVE is a public record that a software flaw exists. CISA’s KEV catalog is narrower: it lists vulnerabilities for which the agency has reliable evidence of active exploitation. Crypto theft figures are a separate measure, often estimated from transactions and adjusted for funds frozen or returned.
The distinction is important when comparing the numbers. Meyer calculates that October KEV additions equaled about 0.2% of that month’s new CVE records, compared with about 0.5% in October 2024. Those ratios describe two datasets with different inclusion rules; they are not estimates of the share of all vulnerabilities that attackers exploited. Google’s threat intelligence group, as summarized by Meyer, estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The group also reported that exploitation had risen roughly in step with disclosure over its analysis period, and that zero-day activity had increased moderately, from an average of eight to 11 per month.
The CVE counts also depend on how records are assigned and counted. Meyer reports that Google’s threat intelligence group identified automated assignment practices as a factor in higher totals, including about 5,000 Linux-kernel-related CVEs from January through August 2026 with no observed zero-day exploitation. Separately, Google’s Big Sleep project reportedly found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show that research and recordkeeping methods shape the numbers, as well as the underlying security conditions.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer
What the October Counts Cannot Show
The reported totals do not establish that AI caused the CVE record, the rise in KEV entries, or the crypto losses. The source identifies particular AI-assisted discoveries and describes a concern that attackers can use AI to adapt public fixes, but it does not provide a comprehensive measure of AI’s role across October’s attacks. It also does not quantify how many of the month’s newly published CVEs were exploited.
The crypto figure is attributed to CertiK and is stated after frozen and returned funds; the source does not provide a detailed incident-by-incident accounting or methodology in the supplied material. The FBI attribution of the Binance theft to North Korea’s TraderTraitor group is reported by Meyer, but the source does not include the FBI’s underlying evidence. It says the theft began with a compromised laptop, without supplying technical details about how that compromise occurred.
The NVD total is Meyer’s count from an API query, not a claim that every record represents a newly discovered, equally serious flaw. The source also reports that the CVE total changes when rejected records are included. The complete breakdown of October’s vulnerability records, the number that led to successful attacks, and the ultimate amount of crypto funds permanently lost remain unclear from the material provided.
Tracking Exploits and AI’s Role
Security teams will be able to compare these figures with subsequent updates to the NVD and CISA’s KEV catalog, which may add evidence of exploitation after a vulnerability is disclosed. The next useful test is whether the gap between published records and cataloged exploited flaws persists, narrows, or widens, using comparable periods and counting methods.
Further reporting on the Binance theft could clarify the attack path, the evidence behind the FBI’s attribution, and how much of the reported loss was ultimately recovered. For AI, stronger conclusions will require documented cases that distinguish AI-assisted defensive research from attacker use and identify when a tool materially changed an exploit or response. Meyer’s November 1 account describes a consequential month, while leaving those broader causal questions open.
Key Questions
How many CVE records were published in October 2026?
Thorsten Meyer’s count from the NVD API found 17,060 records published in October, excluding rejected records. He says the total would be 17,481 if rejected records were included.
Did CISA report a similar increase in exploited vulnerabilities?
No. CISA added 36 vulnerabilities to its KEV catalog in October 2026, compared with 31 in October 2025. That increase was much smaller than the rise in CVE disclosures. The two measures also count different things.
What is confirmed about the Binance theft?
The source reports CertiK’s estimate that October crypto losses totaled $3.47 billion after frozen and returned funds, with Binance accounting for 96.7%. It says the FBI attributed the Binance theft to North Korea’s TraderTraitor group on October 31. The supplied material does not include the FBI’s evidence or a full technical account of the theft.
Does October’s data show that AI caused the surge in vulnerabilities?
No. The source describes AI-assisted vulnerability research, including flaws credited to OpenAI’s Patch the Planet program and Google’s Big Sleep project. It does not establish that AI caused the overall rise in CVE disclosures or the Binance theft.
Source: ThorstenMeyerAI.com
