🔍 Read the full analysis: AI Meets Record CVEs And Crypto Crime In Black October 2026 on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source reports a record 17,060 CVE records published by the NVD in October 2026 and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. CertiK counted $3.47 billion in crypto losses after frozen and returned funds, with the source saying the FBI attributed the Binance theft to North Korea. AI-assisted vulnerability discovery and exploit development featured in several cases, but the source does not establish that AI caused the CVE surge or the Binance theft.
A November 1 report says October 2026 set a monthly high for published CVE records, with 17,060 in the U.S. National Vulnerability Database, while CISA added 36 vulnerabilities to its list of flaws known to be exploited. The same report cites $3.47 billion in crypto losses for the month, according to CertiK’s count after frozen and returned funds, and describes several cases in which AI contributed to finding or exploiting vulnerabilities. The figures track different things; they do not show that AI caused the record disclosures or the reported thefts.
The NVD count comes from the report author’s query of the database API on November 1, counting records by publication date and excluding rejected records. October’s 17,060 records compare with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the report counts 89,859 records in 2026, compared with 39,639 in 2025. The author says October’s total would be 17,481 if rejected records were included, underscoring that the result depends on the counting method.
CISA’s Known Exploited Vulnerabilities catalog, in its October 30 version, received 36 additions in October, compared with 31 in 2025 and 17 in 2024. The report counts 282 additions from January through October 2026, already more than the 245 recorded across all of 2025. Five October additions were older vulnerabilities from 2015 to 2023 for which new evidence of exploitation had emerged. A catalog addition indicates evidence of exploitation, not that every listed flaw is being used at the same scale.
On crypto losses, the report attributes a $3.47 billion October total to CertiK after frozen and returned funds, compared with $68 million in October 2025. It says the Binance incident accounted for 96.7% of the month’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The source describes more than $6 billion leaving Binance in a single evening on October 29; it does not reconcile that figure with CertiK’s net loss estimate, so the two measures should not be treated as equivalent.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The figures matter because vulnerability disclosures, confirmed exploitation and financial losses are separate indicators. The report’s CVE count rose much faster than CISA’s monthly additions: October disclosures were about four times the year-earlier total, while KEV additions increased from 31 to 36. The report also cites Google Threat Intelligence Group’s estimate that roughly one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That estimate and the NVD count use different methods and should not be read as a direct measure of the risk posed by any particular flaw.
For security teams, a larger disclosure pool can mean more work to review and prioritize, but raw record volume does not by itself measure danger. CISA’s exploited-vulnerability catalog offers a narrower signal for prioritization, although it is not a complete account of all exploitation. The crypto losses are a separate measure of harm: the source says Binance made up most of October’s reported total, but does not connect that incident to the month’s CVE records.
AI appears in the report as a factor in some discovery and response activity, not as a demonstrated explanation for all three records. The distinction matters: the report says attackers can use AI to turn fixes into exploits quickly, while also noting that the largest crypto incident it discusses began with a compromised laptop rather than an AI-found software flaw.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
Three Different Security Ledgers
The report separates its data into three categories. A CVE record publicly documents a vulnerability; it does not establish that attackers have used it. CISA’s KEV catalog includes flaws for which the agency has reliable evidence of active exploitation. Crypto-loss figures, by contrast, track reported financial losses and may change when funds are frozen or returned.
The author’s NVD series counts 32,466 records in January–October 2024, 39,639 in the same period of 2025 and 89,859 in 2026. The report cautions that automated assignment policies can affect totals. It cites Google’s threat intelligence group as saying descriptions that mention the Linux kernel alone produced about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that set. These counts therefore do not mean that every record represents a newly discovered, actively exploited security emergency.
The report also describes specific AI-related work. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It attributes the PHP2Shell PHP flaws patched on October 21 to OpenAI’s Patch the Planet program, and says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These are reported examples, not evidence that AI explains the broader increase in CVE publication.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, author of the November 1 report
What the October Counts Cannot Show
The report does not establish why NVD publication totals rose so sharply, how many October CVEs were actively exploited, or whether AI materially drove the overall increase. The author cites Google’s assessment that exploitation rose roughly in step with disclosure, and says zero-days increased only moderately, from an average of eight to 11 a month. Those measures cover different periods and are not a full accounting of all incidents.
The source also does not provide a detailed incident timeline or technical account of the Binance theft. It reports that more than $6 billion left Binance on October 29 and that the FBI attributed the incident to North Korea’s “TraderTraitor” on October 31, while CertiK’s net loss figure is $3.47 billion after frozen and returned funds. The basis and relationship between the gross outflow and net loss figures are not explained in the supplied material.
Finally, the report’s claim that an embargo on PHP2Shell broke before release is not accompanied here by details of when the information became public, who exploited it or what evidence supports the timing. The broader claim that AI can help attackers turn fixes into exploits within days is presented as the author’s assessment, not as a quantified finding across the month’s incidents.
Track New Exploitation Evidence
The next useful checks are whether CISA adds further October-disclosed flaws to KEV, whether incident investigations clarify the Binance loss figures and attribution, and whether vendors publish more detail about the AI-related vulnerabilities. The report’s counts are a snapshot: the NVD and KEV catalogs can change as records are updated and evidence of exploitation emerges.
Security teams can use the report’s distinction between disclosure and exploitation to avoid treating every new CVE as equally urgent. They will still need to assess affected products, available patches and credible exploitation evidence for their own systems. The source offers no later results or confirmed schedule for further updates, so the scale of any follow-on activity remains unknown.
Key Questions
What records did October 2026 set, according to the report?
The report counts a monthly high of 17,060 NVD CVE records and 36 October additions to CISA’s Known Exploited Vulnerabilities catalog. It also cites CertiK’s $3.47 billion estimate of crypto losses after frozen and returned funds; that is a separate measure, not a vulnerability record.
Does the CVE surge mean attackers exploited four times as many flaws?
No. The fourfold comparison is for NVD records published in October 2026 versus October 2025. CISA added 36 vulnerabilities to KEV in October 2026, compared with 31 a year earlier. Disclosure totals and confirmed exploitation are different measures.
What does the report say about AI and vulnerabilities?
It gives examples of AI-related discovery and remediation, including PHP flaws attributed to OpenAI’s Patch the Planet program and findings from Google’s Big Sleep. It does not establish that AI caused the overall CVE increase.
Who did the FBI attribute the Binance theft to?
The report says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. It also cites a gross outflow of more than $6 billion and CertiK’s $3.47 billion net-loss estimate after frozen and returned funds; the source does not explain the difference in detail.
Source: ThorstenMeyerAI.com
