🔍 Read the full analysis: How AI Became Part Of The Fight In Black October 2026 on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The source reports a record 17,060 CVE records published in October 2026, 36 additions to CISA’s Known Exploited Vulnerabilities catalog and a Binance theft attributed by the FBI to North Korea. It documents AI’s role in finding some software flaws, but the figures do not show that the CVE surge translated into a comparable rise in exploitation, and the source says the Binance theft began with a compromised laptop.
October 2026 brought a record number of published vulnerability records, a rise in flaws added to the U.S. government’s active-exploitation list and a Binance theft exceeding $6 billion, according to an analysis published November 1 by ThorstenMeyerAI.com. The report documents AI systems helping find software flaws, but its data also show that disclosures rose far faster than known exploitation, leaving the role of AI in the month’s wider wave of attacks unresolved.
The analysis counted 17,060 new CVE records in the National Vulnerability Database in October, excluding rejected records. That was four times the 4,273 recorded in October 2025. From January through October, it counted 89,859 records, compared with 39,639 over the same period a year earlier. The author says the figures came from a query of the NVD API on November 1; including rejected records would put October’s total at 17,481.
A separate measure of confirmed exploitation rose less sharply. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025. Its total additions for 2026 had reached 282 by October 30, surpassing the 245 added in all of 2025. These figures are not directly equivalent to the CVE count: the catalog records flaws for which CISA has evidence of active exploitation, while CVEs record publicly disclosed vulnerabilities.
The report also cites CertiK’s estimate of $3.47 billion in crypto losses for October after frozen and returned funds, against $68 million in October 2025. It says the Binance incident accounted for 96.7% of that month’s total. On October 31, the FBI attributed the theft to North Korea’s TraderTraitor group. The source describes the incident as beginning with a compromised laptop, not a vulnerability identified by AI.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
AI’s Role in Finding and Fixing Flaws
The month’s figures matter because they separate three different signals: published disclosures, documented exploitation and reported financial losses. A record in one ledger does not automatically establish a record in the others. In this case, the CVE count quadrupled year over year for October, while CISA’s monthly additions rose from 31 to 36. The gap cautions against treating every newly published vulnerability as an active threat.
The report describes evidence of AI-assisted security research. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It also says PHP flaws known as PHP2Shell were found through OpenAI’s Patch the Planet program and patched on October 21. Google’s Big Sleep, meanwhile, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer during a six-month comparison, according to the source.
Those examples make AI’s growing place in vulnerability research concrete, but they do not establish that AI caused October’s record disclosure count or the Binance theft. The report’s author argues that AI can help attackers turn public fixes into exploits quickly, and says the PHP2Shell embargo broke before release. That is an interpretation of the cases, not proof that AI drove the month’s overall attack activity.
Popular right now
Ninja Foodi Smart 6-in-1 Indoor Grill and Air Fryer, 4 Qt, FG551
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
Three Different Security Ledgers
The source organizes October’s data into three measures. CVE records track disclosed flaws; CISA’s KEV catalog tracks vulnerabilities with reliable evidence of exploitation; crypto-loss estimates track reported thefts and recoveries. Each answers a different question, and their totals should not be read as interchangeable measures of danger.
For the CVE count, the author says records were grouped by publication date using the NVD API, with rejected entries excluded. The report notes that counting methods affect the result and that the number of a CVE identifier is not itself a count of published vulnerabilities. It also cites Google’s Threat Intelligence Group, which has warned that automated assignment practices can inflate totals. The source says roughly 5,000 records mentioning the Linux kernel were published from January through August 2026, with no observed zero-day exploitation among that group.
The exploitation picture was rising, too. The source cites a September 30 Google Threat Intelligence Group analysis that counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, more than the 127 counted for all of 2025. CISA’s October catalog additions included flaws affecting remote-access gateways, firewalls, security appliances and other widely used software, as well as five older vulnerabilities from 2015 to 2023 for which new exploitation evidence had emerged.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, ThorstenMeyerAI.com
What the October Numbers Cannot Prove
The figures do not establish that AI caused the CVE surge, that the increase in published records corresponds to a similar increase in real-world attacks, or that AI was used in the Binance theft. The source explicitly says the Binance incident began with a compromised laptop, while its wider claim that attackers are using AI to turn fixes into exploits within days is the author’s view rather than a measured finding across all attacks.
The source’s figures also have defined limits. CVE totals depend on the counting method and publication date, while CISA’s KEV additions are evidence-based entries rather than a complete count of every exploited vulnerability. The cited crypto-loss number is an estimate after frozen and returned funds; the source does not provide a detailed breakdown of the calculation or independent confirmation of every component.
It is also not clear from the material how many of October’s disclosed flaws were found by AI, how many were exploited with AI assistance, or how quickly attackers used individual fixes. The examples of Microsoft, PHP2Shell and Google’s Big Sleep show specific research activity, not the overall share of vulnerabilities or attacks attributable to AI.
Tracking Exploitation After Disclosure
The next useful comparison will be whether newly disclosed vulnerabilities continue to appear in CISA’s KEV catalog, and how quickly that happens. Disclosure counts alone cannot show attacker activity; later evidence of exploitation, incident investigations and patch timelines will help clarify which October records posed immediate risks.
Security teams and software users will need to follow vendor advisories and apply relevant fixes, particularly for products named in the source’s KEV discussion. The material does not announce a specific next investigation or publication date, and it does not say whether further details about the Binance incident or AI-assisted attacks are expected. The available evidence therefore supports continued monitoring, rather than a conclusion that AI caused a new, quantified wave of attacks.
Key Questions
What happened in October 2026?
The source reports a record 17,060 CVE records published in the NVD, 36 additions to CISA’s Known Exploited Vulnerabilities catalog and a crypto-loss estimate of $3.47 billion after frozen and returned funds. It also reports that the FBI attributed the Binance theft to North Korea’s TraderTraitor.
Does the record CVE count mean attacks quadrupled?
No. The fourfold comparison is for October CVE disclosures versus October 2025, not for attacks. CISA added 36 flaws to its exploitation catalog in October 2026, compared with 31 a year earlier.
What role did AI play in vulnerability research?
The report says AI models or AI vulnerability research firms were credited in at least 65 entries in Microsoft’s October security release. It also cites OpenAI’s Patch the Planet program in connection with PHP2Shell and Google’s Big Sleep research on Chrome’s JavaScript engine.
Was AI linked to the Binance theft?
The source does not link AI to the theft. It says the FBI attributed the incident to North Korea’s TraderTraitor and describes the attack as beginning with a compromised laptop.
What remains uncertain?
The available material does not quantify how many October attacks used AI, how much AI contributed to the record disclosure total, or how often newly disclosed flaws were exploited. The source’s claim that attackers can use AI to turn fixes into exploits quickly is presented as the author’s view, not a comprehensive measurement.
Source: ThorstenMeyerAI.com
