🔍 Read the full analysis: Black October 2026, Episode One: The CVEs, Crypto Heist And AI Connection on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis by Thorsten Meyer reports 17,060 new CVE records in October and $3.47 billion in crypto losses, including a reported $6 billion Binance outflow that the FBI attributed to North Korea. CISA added 36 vulnerabilities to its exploited-flaw catalog, a much smaller increase than the disclosure surge. The analysis documents AI-linked vulnerability research and patching, but does not establish that AI caused the month’s overall rise in disclosures or theft.
October 2026 saw a sharp rise in reported vulnerability disclosures and crypto losses, while additions to the U.S. government’s catalog of actively exploited flaws grew more modestly, according to a November 1 analysis by Thorsten Meyer. The report also identifies AI-linked vulnerability research and patching, but its figures do not show that AI caused the month’s overall surge or the reported Binance theft.
Meyer says the National Vulnerability Database (NVD) published 17,060 new CVE records in October, compared with 4,273 in October 2025. His count, taken from the NVD API on November 1 and excluding rejected records, puts January-to-October totals at 89,859 in 2026 and 39,639 in 2025. He notes the count changes if rejected records are included: October’s total would be 17,481.
The increase in records was not matched by the same pace of growth in CISA’s Known Exploited Vulnerabilities catalog. CISA added 36 flaws in October, versus 31 in October 2025. Its catalog recorded 282 additions from January through October 2026, already above the 245 added during all of 2025. These are different measures: CVE records document disclosed vulnerabilities, while KEV entries reflect vulnerabilities CISA considers to have evidence of exploitation.
The report cites CertiK’s estimate of $3.47 billion in October crypto losses after accounting for frozen and returned funds, compared with $68 million in October 2025. It says Binance accounted for 96.7% of the monthly amount. The source reports that the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. The article’s supplied material does not independently provide details of the FBI’s evidence or explain how the reported Binance amount relates to the broader loss estimate.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploited Flaws
The figures matter because a rise in published vulnerabilities does not translate directly into an equal rise in successful attacks. Meyer’s comparison shows the disclosure count growing far faster than CISA’s monthly additions: October CVEs rose from 4,273 to 17,060 year over year, while KEV additions rose from 31 to 36. The distinction can help readers and security teams avoid treating every published record as an active threat.
That does not mean the exploitation trend is flat. CISA’s 282 additions through October exceeded its total for 2025, and the report says Google Threat Intelligence Group (GTIG) found more vulnerabilities disclosed and exploited during January to August 2026 than in all of 2025. The figures use different time windows and methods, so they should not be collapsed into a single measure of risk.
The crypto estimate points to a separate concern: reported losses can be dominated by a single incident. According to the source, Binance made up nearly all of October’s $3.47 billion net loss estimate. Meyer says the theft began with a compromised laptop rather than an AI-found vulnerability. That account, if accurate, cautions against treating the month’s AI security findings as an explanation for every major incident.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, KSM150PS, Almond Cream
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames the report around three “ledgers”: disclosed flaws, flaws recorded as exploited, and cryptocurrency losses. A CVE is a public record of a vulnerability; its appearance does not by itself show that attackers have used it. CISA’s KEV catalog is intended to list flaws for which there is reliable evidence of exploitation. Crypto loss estimates track a different outcome and are subject to the counting choices, recovery status and attribution described by the source.
The report also describes AI’s role in security research. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He says the PHP2Shell flaws, patched October 21, came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s fuzzer over six months. These are reported examples of AI-linked discovery and remediation, not evidence that AI produced October’s overall record.
Meyer also cites GTIG’s observation that automated assignment practices can inflate CVE totals. In its January-to-August figures, GTIG reportedly counted about 5,000 Linux-kernel-related CVEs with no observed zero-day exploitation. The example illustrates why disclosure totals need to be read alongside evidence about exploitation, rather than used alone as a measure of attacks.
““I keep them apart, because they measure different things.””
— Thorsten Meyer, describing the three measures
What the October Counts Cannot Show
The figures do not establish why NVD disclosures rose so sharply, or how much of the increase reflects additional discoveries, reporting practices or automated CVE assignment. Meyer’s totals are his count of NVD API records under a stated method; they are not a direct count of unique flaws exploited by attackers. The source also notes that including rejected records changes October’s total.
It is also unclear from the material provided how the reported Binance loss was calculated, what evidence supports the FBI’s attribution, and whether all reported October crypto losses use the same accounting basis. The FBI attribution and CertiK estimate should be treated as claims reported by the source, not as independently verified findings in this article.
Finally, the AI examples show that models and AI-focused research programs were credited in specific vulnerability work. They do not establish that AI caused the rise in CVE publication, shortened attacker timelines across the board, or played a role in the Binance incident. Meyer describes some of those broader conclusions as his view and acknowledges that the month’s evidence both supports and challenges it.
Further Evidence Will Test the Thesis
The next useful checks are updated NVD and CISA counts, more detail on the methods behind crypto-loss estimates, and additional public evidence about the Binance incident and its attribution. Those updates could change October totals or clarify what the records say about actual exploitation.
For the AI question, the evidence to watch is case-specific: disclosures that identify how a flaw was found, when a patch became available, whether details escaped before release, and whether attackers then used the flaw. Meyer’s report argues that attackers can use AI to turn fixes into exploits quickly, but the supplied material does not quantify that trend across all vulnerabilities. Further documented cases will be needed to assess how common it is.
Key Questions
How many CVE records were published in October 2026?
Meyer’s count of NVD API records, excluding rejected records, is 17,060. He says the count would be 17,481 if rejected records were included.
Did CISA record a matching rise in actively exploited flaws?
No. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October 2026, compared with 31 in October 2025. The catalog’s year-to-date total was 282 through October, above all of 2025’s 245 additions.
What is reported about the Binance theft?
The source says Binance accounted for 96.7% of CertiK’s estimated $3.47 billion in October crypto losses and reports that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The supplied material does not include the underlying attribution evidence.
Does the report prove AI caused the October records or theft?
No. It cites AI-linked vulnerability research and patching, including work associated with Microsoft, OpenAI and Google. Those examples do not establish that AI caused the overall increase in CVE disclosures or the Binance theft.
Source: ThorstenMeyerAI.com
