🔍 Read the full analysis: Black October 2026, Episode One: How AI Fits Into The Fight on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis by Thorsten Meyer reports that October 2026 set records for published CVEs and cryptocurrency losses, while CISA’s exploited-vulnerability additions rose more modestly. The source documents AI-assisted vulnerability research and patching, but says the evidence does not establish that AI drove the month’s overall attack activity.
Meyer says the National Vulnerability Database (NVD) published 17,060 new CVE records in October, excluding rejected records, compared with 4,273 in October 2025. His count, based on the NVD API, puts January-to-October disclosures at 89,859 in 2026, versus 39,639 over the same period in 2025. He cautions that totals depend on counting methods: including rejected records would put October’s figure at 17,481.
The exploitation measure rose less sharply. The CISA Known Exploited Vulnerabilities catalog added 36 flaws in October, compared with 31 in October 2025 and 17 in October 2024. CISA had made 282 additions by the end of October 2026, already above the 245 added in all of 2025. The catalogs measure different things: CVEs record disclosed flaws, while KEV entries reflect evidence of active exploitation.
For crypto losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds, compared with $68 million in October 2025. He says Binance accounted for 96.7% of the October total and that the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. The source describes the event as a record theft, but the figures and attribution are claims reported by the cited organizations, not independently verified here.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The central point is that more reported vulnerabilities do not automatically mean more successful attacks. Meyer’s figures show October CVE disclosures increasing far faster year over year than additions to CISA’s KEV catalog. That distinction matters to organizations deciding how to prioritize security work: the volume of public records is not, by itself, a measure of how many flaws attackers are using.
At the same time, the source says KEV additions in 2026 had already exceeded the prior full-year total by October. It also cites Google’s threat intelligence group as finding that exploitation had risen roughly in step with disclosure over a longer period, and that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. These are separate measures and should not be collapsed into a single claim about the month’s risk.
The AI angle is similarly mixed. Meyer points to AI-linked bug discovery and fixes, and argues that attackers can use AI to turn public fixes into exploits quickly. But the source also says the month’s largest crypto loss began with a compromised laptop, not an AI-discovered vulnerability. The evidence supports a discussion of changing security tools, not a conclusion that AI caused October’s records.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 34-Inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer organizes October’s figures into three ledgers: disclosed vulnerabilities, documented exploitation and reported crypto theft. A CVE is a public record that a vulnerability exists; it does not establish that the flaw has been attacked. CISA’s KEV catalog is narrower, listing vulnerabilities for which the agency has evidence of exploitation. Crypto-loss estimates track a different kind of event and cannot be directly compared with either database.
The source reports that CVE counts rose through 2026, exceeding 12,000 in August and 14,900 in September before reaching October’s reported high. It also relays a caution from Google’s threat intelligence group: automated assignment practices can inflate totals. Meyer says descriptions mentioning the Linux kernel alone generated about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation in that group.
On AI-assisted security work, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. He says PHP2Shell flaws patched on October 21 came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show reported security research activity; they do not establish AI’s overall effect on attack rates.
“Only about 1 in 431 vulnerabilities disclosed in 2026 was seen exploited.”
— Google Threat Intelligence Group, as summarized by Meyer
What the October Figures Cannot Show
The figures do not establish whether AI caused the increase in disclosed vulnerabilities, the rise in known exploitation or the reported crypto losses. Meyer labels the idea that October marked a new phase of AI-driven hacking as his interpretation, not a measurement. He also says the largest theft described in the analysis began with a compromised laptop, rather than a flaw found by AI.
The source does not provide enough detail to independently check every underlying dataset, the precise calculation of CertiK’s net losses, or the full evidence behind the FBI attribution. CVE and KEV totals also rely on different inclusion rules and timelines, so their ratio is not a direct measure of the probability that any individual vulnerability will be exploited. The supplied source ends mid-sentence while discussing Google’s longer-term exploitation data; no missing details are inferred here.
It is also unclear how much the October disclosure spike reflects more vulnerabilities being found, changes in reporting or assignment practices, or a combination of factors. The article’s AI-linked examples document credited research and patching, but do not quantify how many flaws would otherwise have gone undiscovered or how widely attackers used AI.
Track Exploitation and Patch Outcomes
The immediate next step for readers is to follow new CISA KEV additions separately from CVE publication counts, since they answer different questions. Organizations can also check vendor advisories for affected products named in the October catalog additions, including remote-access gateways, security appliances and widely used software. The source does not identify a single forthcoming report or deadline that would settle the broader AI question.
Meyer’s video, “Black October 2026, Episode One,” presents the three ledgers and the AI evidence in an animated five-minute account. He says its narration uses an AI voice clone of himself and its images are AI-generated. Further comparisons across coming months could show whether elevated disclosures and exploitation persist, but the supplied material does not establish what those future figures will be.
Key Questions
What is “Black October 2026” about?
It is Thorsten Meyer’s analysis of October’s vulnerability disclosures, known exploitation, crypto losses and AI-assisted security research. He argues that the evidence supports some, but not all, of his concerns about AI’s role in cyberattacks.
How many vulnerabilities did the NVD publish in October?
Meyer’s count of NVD records published in October 2026 is 17,060, excluding rejected records. He says the count would be 17,481 if rejected records were included.
Did exploitation rise as quickly as vulnerability disclosures?
No, not in Meyer’s October comparison. CISA added 36 flaws to its KEV catalog, up from 31 in October 2025, while reported CVE disclosures rose from 4,273 to 17,060. The measures track different things and should not be treated as equivalent.
Does the analysis show that AI caused October’s attacks?
According to Meyer, the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The supplied source does not include the FBI’s underlying statement or further details about its evidence.
Source: ThorstenMeyerAI.com
