🔍 Read the full analysis: Black October 2026: Connecting Record CVEs, Crypto Crime And AI on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Thorsten Meyer’s November 1 review says October 2026 brought a record 17,060 published CVE records and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. CertiK estimated $3.47 billion in crypto losses for the month, while the FBI attributed the Binance theft to North Korea’s TraderTraitor. The figures show sharply different trends; they do not establish that AI caused the records or the theft.
A review published by Thorsten Meyer on November 1 says October 2026 set a monthly record for published vulnerability records, while CISA added fewer than four dozen flaws to its list of vulnerabilities known to be exploited. The review also cites CertiK’s estimate of $3.47 billion in October crypto losses and says the FBI attributed the Binance theft to North Korea’s TraderTraitor. The figures describe separate security trends; they do not show that AI caused the overall surge or the crypto theft.
Meyer says his count of the U.S. National Vulnerability Database (NVD), taken through its API on November 1 and excluding rejected records, found 17,060 CVE records published in October. That compares with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count was 89,859, against 39,639 in the same period of 2025. The source notes that including rejected records would put October’s count at 17,481, underscoring that results depend on the counting method.
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October, compared with 31 in October 2025 and 17 in October 2024. Cumulative additions reached 282 from January through October 2026, exceeding the 245 additions reported for all of 2025. The source says five October entries were older vulnerabilities, published between 2015 and 2023, for which new exploitation evidence had emerged.
For crypto, Meyer cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds, compared with $68 million in October 2025. The review says the Binance incident accounted for 96.7% of the October total and reports that the FBI attributed that theft to North Korea’s TraderTraitor on October 31. These are attributed figures and findings, not an independent assessment in this article.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why the Three Security Counts Differ
The records matter, but they measure different things. CVE publication counts indicate how many vulnerability records entered the public database, not how many flaws were exploited or how severe they were. CISA’s KEV catalog is narrower: it lists flaws for which the agency has reliable evidence of exploitation. Crypto-loss estimates track another kind of event and should not be added to vulnerability counts as if they measured the same risk.
The divergence is the central finding in Meyer’s review. October CVE publications were about four times the year-earlier count, while KEV additions rose from 31 to 36. Using the source’s figures, KEV additions were roughly 0.2% of October CVE publications in 2026, compared with about 0.5% in October 2024. That ratio is not a measure of the share of vulnerabilities that will ever be exploited: catalog additions and publication counts have different scope and timing.
For security teams, the practical point is to avoid treating a large disclosure count as a direct proxy for active attacks. KEV entries provide evidence of exploitation, while the broader NVD record can help identify software that needs review. The reported Binance loss, meanwhile, shows the potential scale of crypto crime, but the source says the incident began with a compromised laptop—not an AI-discovered software flaw.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
FLEXISPOT 36-Inch Height-Adjustable Standing Desk Converter, Black
As an affiliate, we earn on qualifying purchases.
How October’s Ledgers Were Counted
Meyer describes three ledgers: disclosed flaws, flaws with evidence of active exploitation, and reported crypto theft. His NVD count uses publication dates and excludes rejected records. He cautions that counting choices affect the result and that CVE identifiers themselves are not a count of published vulnerabilities; numbering authorities can reserve blocks of IDs.
The review also cites Google’s threat intelligence group (GTIG), which said automated assignment practices can inflate CVE totals. GTIG reportedly counted about 5,000 CVEs mentioning the Linux kernel from January through August 2026, with no observed zero-day exploitation among that group. In a separate longer-term comparison, GTIG said it recorded 141 distinct vulnerabilities disclosed and exploited between January and August 2026, more than the 127 it counted for all of 2025. Those figures use a different measure and period from the NVD and CISA monthly tallies.
On AI, the source says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It also says PHP flaws patched on October 21, described as PHP2Shell, came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. These examples show reported AI involvement in vulnerability research; they do not establish that AI drove the month’s overall CVE increase.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, in the November 1 review
What the October Counts Cannot Show
The source does not establish that AI caused October’s CVE record, the rise in KEV additions, or the Binance theft. Its examples concern AI involvement in vulnerability research and the use of AI to help turn fixes into exploits; Meyer presents the wider claim about attack acceleration as his interpretation, not as a measured finding. The source also says PHP2Shell’s embargo broke before release, but gives no detailed chronology or independent account of how that occurred.
The NVD and KEV numbers are counts of records and catalog additions, not counts of successful attacks, affected systems, or resulting harm. The source flags that automated CVE assignment can affect totals, and that its NVD figures change when rejected records are included. The $3.47 billion estimate is attributed to CertiK and is stated after frozen and returned funds; the review does not provide a transaction-by-transaction breakdown or a full method for reconciling estimates.
The review reports the FBI’s attribution of the Binance theft to North Korea’s TraderTraitor, but does not include the FBI’s supporting evidence or a response from Binance. The precise route of compromise, the number of affected users, and the status of any recovery efforts are not specified in the supplied material.
Tracking Exploitation and Attribution
The next useful checkpoints are updates to CISA’s KEV catalog and later NVD totals, which can show whether the October divergence between disclosures and known exploitation continues. Security teams will also be watching whether affected vendors issue follow-up advisories about the vulnerabilities named in the review, including remote-access gateways, security appliances, and software platforms.
For the AI claims, further documented cases would be needed to measure how often models find actionable flaws, how quickly attackers use public fixes, and whether AI changes exploitation rates rather than simply increasing research output. On the crypto incident, the review supplies an FBI attribution but no further investigative milestones. Details about the compromise, the amount ultimately recovered, and any formal law-enforcement or Binance updates remain pending in the source material.
Key Questions
What security records did October 2026 set?
Meyer’s NVD API count found 17,060 CVE records published in October, excluding rejected records. CISA added 36 entries to its KEV catalog that month. The first is a disclosure count; the second tracks vulnerabilities CISA lists as exploited.
Did the number of exploited vulnerabilities rise as fast as CVE publications?
No, not in the figures cited by the review. October CVE publications rose from 4,273 in 2025 to 17,060 in 2026, while CISA KEV additions rose from 31 to 36. The counts have different definitions and do not establish the eventual exploitation rate for newly published flaws.
How much crypto loss did the review report for October?
The review cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds, compared with $68 million in October 2025. It says the Binance theft accounted for 96.7% of the monthly total.
What did the FBI say about the Binance theft?
According to Meyer’s review, the FBI attributed the theft to North Korea’s TraderTraitor on October 31. The supplied material does not provide the FBI’s evidence or further details about the compromise.
Does the review show that AI caused the October surge?
No. It describes AI-related vulnerability research examples and argues that AI may help attackers adapt fixes into exploits, but Meyer labels that broader view as a thesis. The figures provided do not establish that AI caused the record CVE count or the Binance theft.
Source: ThorstenMeyerAI.com
