🔍 Read the full analysis: How AI Featured In Black October 2026’S Cybersecurity Headlines on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 report on October 2026 describes a record 17,060 new CVE records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. It also cites AI-assisted vulnerability research and patching, while warning that the rise in disclosures far outpaced documented exploitation and that the month’s largest reported crypto theft was attributed to a compromised laptop, not an AI-found flaw.
October 2026 set a monthly record for newly published vulnerability records, while U.S. agencies logged a more modest increase in flaws with evidence of active exploitation, according to figures in a November 1 analysis by Thorsten Meyer. The report also documents AI’s role in finding and fixing some vulnerabilities, but says October’s data do not establish that AI caused a broad rise in cyberattacks.
Meyer’s count of the National Vulnerability Database (NVD), queried through its API on the morning of November 1 and excluding rejected records, found 17,060 CVEs published in October. That compares with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count was 89,859, compared with 39,639 over the same months of 2025. The figures measure published records, not confirmed attacks or unique incidents.
The report counted 36 additions to CISA’s Known Exploited Vulnerabilities catalog in October, up from 31 in October 2025 and 17 in 2024. The catalog identifies vulnerabilities for which CISA cites reliable evidence of exploitation. Its 282 additions from January through October 2026 had already exceeded the 245 added during all of 2025. The increase in these entries was far smaller than the jump in CVE publications.
On AI, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. He also reports that PHP2Shell vulnerabilities, patched on October 21, came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples document research and remediation work; they do not show that AI was responsible for October’s overall disclosure surge.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Disclosure Counts Need Context
The contrast between the two security measures matters to organizations deciding what to patch first. A high CVE count can signal more vulnerabilities becoming public, but it does not show how many are being used against real systems. CISA’s KEV additions offer a narrower measure of observed exploitation, and they rose much less quickly than disclosures in October. Meyer cites Google threat intelligence research estimating that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That is a reported estimate, not a guarantee that unlisted flaws are safe.
The report’s practical warning is about the time between disclosure and attack. Meyer argues that attackers can use AI to turn fixes or public technical details into exploits quickly, and says the PHP2Shell embargo broke before release. The source material does not provide enough detail to independently establish how widely or how quickly that happened. Still, defenders face a real prioritization problem: monitor evidence of exploitation, assess exposed systems, and apply patches, rather than treating every published CVE as equally urgent.
The financial figures also show why different kinds of security events should not be collapsed into one headline. CertiK put October crypto losses at $3.47 billion after frozen and returned funds, with Binance accounting for 96.7% of the month’s total. The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31, according to Meyer. A large theft is not, by itself, evidence that AI discovered the vulnerability or enabled the intrusion.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
Three Measures of October’s Risks
Meyer separates October’s figures into three measures: disclosed vulnerabilities, vulnerabilities listed as exploited, and cryptocurrency losses. They capture different events. A CVE is a public record that a vulnerability exists; the NVD total counts records by publication date. CISA’s KEV catalog is narrower, including flaws for which the agency says there is reliable evidence of active exploitation. Crypto-loss estimates track reported losses and may change when funds are frozen or returned.
The CVE count also depends on method. Meyer says the October total would be 17,481 if rejected records were included, rather than 17,060. He cautions that CVE identifiers themselves are not a measure of published vulnerabilities, since numbering authorities can reserve large blocks. The report cites Google threat intelligence research that automated assignment policies can inflate totals; it says descriptions mentioning the Linux kernel generated about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that group.
Google’s threat intelligence group, in findings Meyer attributes to a report published September 30, counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. The source says the average rose from 10.5 per month in 2025 to 18 per month in the first eight months of 2026. These figures use a different time window and methodology from the October KEV count, so they should not be treated as interchangeable.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, describing his assessment of the evidence
What October’s Figures Cannot Prove
The figures do not establish that AI caused the record number of CVE publications or that it drove a month-wide rise in successful attacks. The source gives examples of AI-assisted vulnerability research and says attackers use AI to turn fixes into exploits within days, but it does not supply a complete dataset measuring the frequency, effectiveness or attribution of AI-assisted exploitation. Its claim that the PHP2Shell embargo broke before release is not accompanied here by a timeline or independent corroboration.
The NVD and KEV counts also describe different things and do not cover every vulnerability or incident. Meyer’s CVE totals are his API-based count, and the result changes if rejected records are included. Crypto-loss estimates can shift after funds are frozen or returned. The source attributes the Binance theft to North Korea’s TraderTraitor based on an FBI statement, but the supplied material does not explain the intrusion method in detail; Meyer says it began with a compromised laptop, not an AI-found bug.
Patch Priorities After October
For security teams, the immediate next step is to check exposed systems against CISA’s KEV catalog and vendor advisories, then apply relevant fixes according to exposure and available evidence of exploitation. October’s disclosure count is a reason to track vulnerability reporting, but it is not a substitute for assessing whether a particular product is deployed or vulnerable.
Further reporting can test Meyer’s thesis by tracking whether exploitation keeps rising, how quickly newly disclosed flaws appear in active attacks, and whether AI is documented as part of vulnerability discovery or exploit development. The figures in this report cover October and, for some comparisons, January through October or August; they do not settle what the trend will be in coming months.
Key Questions
What was the main cybersecurity development in October 2026?
The report counted a record 17,060 new CVE records published in October, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. The two figures measure disclosures and documented exploitation, respectively.
Does the record number of CVEs mean attacks increased fourfold?
No. The CVE figure counts published vulnerability records, not attacks. CISA’s KEV additions rose from 31 in October 2025 to 36 in October 2026, a much smaller change than the rise in CVE disclosures.
How did AI feature in the report?
The report cites AI models and research firms credited in Microsoft’s October security release, OpenAI’s Patch the Planet program as the source of PHP2Shell findings, and Google’s Big Sleep bug-finding work. These examples concern vulnerability research and fixes; they do not prove AI caused the month’s wider security trends.
What does the report say about the Binance theft?
It cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds, with Binance accounting for 96.7% of the month’s total. Meyer says the FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31 and describes its starting point as a compromised laptop.
Source: ThorstenMeyerAI.com
