🔍 Read the full analysis: The AI Dimension Of Black October 2026’S CVEs And Crypto Heist on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 brought a record 17,060 published CVE records and $3.47 billion in reported crypto losses, according to the source’s NVD count and CertiK figures. CISA added 36 flaws to its exploited-vulnerability catalog, a smaller increase than the CVE surge. The source documents AI’s role in finding some flaws and speeding exploit development, but does not establish that AI caused the month’s records or the Binance theft.
A November 1 report on October 2026’s cybersecurity figures found record levels of published vulnerabilities and crypto losses, alongside a much smaller increase in flaws listed as actively exploited. It also documented AI’s role in finding some vulnerabilities and helping attackers adapt fixes into exploits, but the figures do not show that AI caused the month’s records or the reported Binance theft.
The report’s count of National Vulnerability Database (NVD) records shows 17,060 new CVEs published in October, excluding rejected records, compared with 4,273 in October 2025. From January through October, it counted 89,859 records in 2026, against 39,639 over the same months of 2025. The author says the figures came from an NVD API query on November 1; including rejected records would raise October’s total to 17,481. These totals measure public disclosures, not confirmed attacks.
The exploited-flaw tally rose less sharply. The report says the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog version dated October 30 showed 282 additions for 2026 through October, already above the 245 added during all of 2025. Five October additions were older vulnerabilities for which new exploitation evidence had emerged.
CertiK’s figures cited in the report put October crypto losses at $3.47 billion after frozen and returned funds, compared with $68 million in October 2025. The report says Binance accounted for 96.7% of October’s total and that the FBI attributed the October 29 theft to North Korea’s TraderTraitor on October 31. The supplied material describes more than $6 billion leaving Binance in one evening, but does not provide enough detail to reconcile that figure with CertiK’s net-loss total.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why CVE Growth Outpaced Exploitation
The difference between vulnerability disclosures and confirmed exploitation is central to understanding the month. More published CVEs do not automatically mean more successful attacks: the report says the NVD count rose fourfold year over year for October, while CISA’s additions increased from 31 to 36. The source also cites Google Threat Intelligence Group (GTIG), which estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The two tallies use different methods and should not be treated as a complete measure of all attacks.
For organizations responsible for internet-facing systems, the KEV list offers a more focused signal than the raw disclosure count because it identifies vulnerabilities CISA considers supported by evidence of exploitation. October’s entries included remote-access gateways, firewalls, security appliances, collaboration and development software, and PHP. That mix points to practical prioritization: defenders need to track which flaws are being used, not just how many CVE records appear.
The crypto figure shows the separate financial impact of security incidents, but it does not establish a connection between AI and the theft. The report says the Binance incident began with a compromised laptop, rather than an AI-discovered vulnerability. Treating the CVE spike, AI-assisted research and crypto loss as one causal event would go beyond the evidence provided.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 7 Crypto Hardware Wallet
Ledger Nano X Bluetooth Crypto Wallet
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Questions
The report separates three kinds of data: disclosed vulnerabilities, vulnerabilities with evidence of exploitation, and publicly visible crypto losses. A CVE is a record that a vulnerability exists; it does not say whether attackers have used it. CISA’s KEV catalog is narrower, tracking flaws for which the agency has evidence of active exploitation. Crypto loss estimates, meanwhile, reflect reported incidents and can change when funds are frozen or returned.
The source reports that CVE totals rose through 2026, surpassing 12,000 in August and 14,900 in September before reaching October’s count. It also cautions that assignment practices affect totals. GTIG was cited as saying descriptions mentioning the Linux kernel accounted for about 5,000 CVEs from January to August, with no observed zero-day exploitation among that group. This is one reason a large disclosure total cannot be read as a direct count of dangerous, actively used flaws.
There is documented AI involvement in vulnerability discovery. The report says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including a flaw already exploited in the wild. It also says PHP2Shell vulnerabilities patched on October 21 came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. Those examples support a role for AI in research, but do not show that AI produced the overall CVE increase.
“Only about 1 in 431 vulnerabilities disclosed in 2026 was seen exploited.”
— Google Threat Intelligence Group, as cited in the report
The source does not establish why NVD publication totals surged or how much of the increase resulted from AI-assisted discovery, changes in assignment practices, or other factors. It cites GTIG’s view that exploitation has risen roughly in step with disclosure, while also reporting a much smaller ratio of observed exploitation to 2026 disclosures. Those statements refer to different comparisons and do not provide a single causal explanation for October’s figures.
The account of the Binance incident also leaves important details unresolved. The report attributes the theft to North Korea’s TraderTraitor based on an FBI statement, and says the entry point was a compromised laptop; the supplied material does not describe the evidence behind that attribution or the full attack sequence. It also does not explain how the claim of more than $6 billion leaving Binance relates to CertiK’s $3.47 billion October loss estimate after frozen and returned funds.
Finally, the examples of AI-assisted vulnerability research do not prove that attackers used AI in each incident, or that AI caused the exploitation of the flaws listed by CISA. The report argues that attackers can turn fixes into exploits within days and says the PHP2Shell embargo broke before release, but it does not supply enough incident-level detail here to assess how broadly that pattern occurred.
Tracking Exploits and Loss Revisions
The next useful check is whether CISA adds more October-disclosed flaws to its KEV catalog as new evidence emerges. The report’s counts are a snapshot: its NVD query was run on November 1, and its KEV comparison uses a catalog version dated October 30. Later revisions could change both the totals and the picture of how quickly newly disclosed flaws are being exploited.
Further reporting on the Binance theft could clarify the FBI’s attribution, the compromised laptop’s role, the amount ultimately lost, and the status of any recovered or frozen funds. Updated incident accounting may also explain the gap between the more-than-$6-billion figure in the source’s opening account and CertiK’s net-loss estimate.
For AI’s role, the key evidence will be specific disclosures linking a model or tool to a vulnerability’s discovery, patching, or exploitation. The October examples show that AI-related research is present in security workflows; they do not settle whether it is driving a broad rise in successful attacks.
Key Questions
How many CVEs did the report count in October 2026?
The author counted 17,060 NVD records published in October, excluding rejected records. The report says the total would be 17,481 if rejected records were included.
Did exploitation rise as quickly as CVE disclosures?
No, according to the report’s figures. CISA added 36 flaws to its KEV catalog in October 2026, compared with 31 a year earlier, while the author’s NVD count rose from 4,273 to 17,060. These measures track different things, and KEV additions are not a count of every attack.
What role did AI play in the reported security activity?
The report identifies AI models and research firms credited in at least 65 entries in Microsoft’s October security release, and cites AI-related work on PHP and Chrome vulnerabilities. It does not show that AI caused the CVE surge or the Binance theft.
What is confirmed about the Binance theft?
The source says more than $6 billion left Binance on October 29, and that the FBI attributed the theft to North Korea’s TraderTraitor on October 31. It also cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds, with Binance accounting for 96.7%. The supplied material does not reconcile those amounts or provide the full incident details.
Source: ThorstenMeyerAI.com
