🔍 Read the full analysis: Can AI Change The Balance In Black October 2026’S Cybersecurity Fight? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A November 1 report says October 2026 set a record for published CVE entries, while CISA’s exploited-vulnerability additions rose more modestly. The source identifies AI-assisted flaw discovery and fast exploit development as concerns, but says the month’s largest crypto theft began with a compromised laptop; much of its broader AI-related thesis remains interpretation.
A November 1 analysis of October cybersecurity data reports 17,060 new CVE records published that month, alongside 36 additions to CISA’s Known Exploited Vulnerabilities catalog and a record-setting crypto theft. The figures show a sharp gap between vulnerability disclosures and documented exploitation, while the source says AI tools helped identify some bugs and may help attackers turn fixes into exploits faster.
Thorsten Meyer says he counted 17,060 NVD records published in October, excluding rejected entries, compared with 4,273 in October 2025. His January-to-October count is 89,859 records in 2026, against 39,639 over the same months in 2025. The totals depend on counting method: including rejected records would raise October’s figure to 17,481, according to Meyer.
The exploitation figures grew less sharply. CISA added 36 vulnerabilities to its KEV catalog in October, compared with 31 in October 2025 and 17 in 2024. CISA’s catalog had 282 additions through October 2026, already more than the 245 added during all of 2025. Five October additions were older flaws, dated from 2015 to 2023, for which new evidence of exploitation had emerged.
The source also reports that CertiK counted $3.47 billion in October crypto losses after accounting for frozen and returned funds, compared with $68 million in October 2025. It says the Binance incident accounted for 96.7% of October’s total, and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The source describes the incident as beginning with a compromised laptop, not an AI-discovered vulnerability.
On AI and vulnerability research, Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including a flaw already exploited in the wild. He says PHP2Shell, patched October 21, came from OpenAI’s Patch the Planet program. He also cites Google’s Big Sleep as finding more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. These examples indicate AI’s role in some security work, but do not establish that AI caused October’s wider rise in disclosures or attacks.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The distinction between a vulnerability being published and attackers using it is central to interpreting October’s record. CVE counts measure disclosed flaws, not successful attacks; a rise can reflect more research, broader automated assignment practices, or other changes in reporting. CISA’s KEV catalog, which records vulnerabilities with evidence of active exploitation, offers a narrower view of what attackers are known to use.
Meyer’s figures show disclosure rising much faster than KEV additions: October CVEs were about four times the October 2025 count, while KEV additions rose from 31 to 36. That does not mean the increase is harmless. The source lists remote-access gateways, firewalls, support tools, software development platforms and other widely used products among October’s exploited flaws. Organizations still need to prioritize verified exploitation, alongside the severity and exposure of each affected system.
The report’s AI argument is more limited than its headline framing. Examples of AI-assisted bug discovery and claims that attackers can use AI to develop exploits quickly raise operational concerns, but the provided figures do not measure how many incidents AI enabled. The month’s largest reported loss also points to a different attack path: the source says it began with a compromised laptop. AI is part of the security picture, not a demonstrated explanation for every October record.
Products Worth Considering
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
Three Different Security Measures
The report separates October into three ledgers: disclosed vulnerabilities, flaws listed as exploited, and crypto funds stolen. Those measures track different events and should not be combined into one count of “hacks.” A CVE record identifies a reported vulnerability; a KEV entry reflects evidence of exploitation; crypto-loss estimates track assets lost, frozen or returned under the source’s methodology.
Meyer says his NVD totals came from an API query on the morning of November 1, using publication dates and excluding rejected records. He notes that CVE totals can also be affected by numbering-authority practices. Citing Google’s threat intelligence group, he says automated assignment policies contributed to large numbers of records, including roughly 5,000 Linux-kernel-related CVEs from January through August 2026, with zero observed zero-day exploitation in that subset.
The source also cites Google threat intelligence figures published September 30: 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. It reports exploitation rising from an average of 10.5 vulnerabilities per month in 2025 to 18 per month in the 2026 period. These are separate measures from CISA’s monthly catalog additions and should not be treated as interchangeable.
“October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 report
The source does not provide a measured count of cyberattacks caused or materially accelerated by AI in October. Its examples show AI credited in vulnerability research and describe attackers using AI to turn fixes into exploits, but the supplied material does not quantify how often that happened or establish causation across the month’s incidents. The claim that an embargo on PHP2Shell broke before release is presented as support for concern about speed, but the account does not provide further timing details here.
It is also unclear how much of the CVE surge reflects a genuine increase in distinct security risk rather than changes in reporting and assignment practices. The source notes that its totals exclude rejected records and that a different method changes October’s count. Crypto-loss figures likewise depend on treatment of frozen and returned assets. The provided material does not include full incident records or independent verification for every figure, so the counts should be understood as attributed estimates and methods described by the source.
Watch Exploitation and Patching
The next useful test is whether the rise in published flaws is followed by sustained growth in documented exploitation. CISA KEV additions, vendor advisories and incident reporting can help show which disclosed bugs are being used in attacks. Security teams should review affected products against their own exposure and patching timelines, with particular attention to flaws already listed as exploited.
Further reporting would be needed to measure AI’s contribution: for example, documented cases that trace AI use in vulnerability discovery or exploit development, with dates and evidence that distinguish AI assistance from conventional techniques. Meyer’s analysis says the discussion will continue through its accompanying video and related coverage of CVE assignment patterns. The supplied material does not state a specific date for another data update.
Key Questions
What cybersecurity records did October 2026 set?
According to Meyer’s analysis, the NVD published 17,060 new CVE records in October, excluding rejected records. The report also describes 36 October additions to CISA’s KEV catalog and $3.47 billion in crypto losses after frozen and returned funds, based on CertiK figures.
Does a record number of CVEs mean a record number of attacks?
No. CVE entries are disclosures of vulnerabilities, not a count of attacks. CISA’s KEV catalog tracks flaws with evidence of active exploitation, and its October additions rose much less sharply than the CVE count, according to the report.
What role did AI play in the reported findings?
The source says AI models or AI vulnerability research firms were credited in at least 65 entries in Microsoft’s October security release, and it cites AI-assisted research that found software bugs. It does not quantify how many October attacks were caused or accelerated by AI.
What does the report say about the Binance theft?
The source says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31, and that the incident accounted for 96.7% of October’s crypto-loss total in CertiK’s figures. It says the theft began with a compromised laptop rather than an AI-found bug.
What should readers watch next?
Watch for new KEV additions, vendor patch information and incident evidence showing whether disclosed vulnerabilities are being exploited. More documented cases would also be needed to establish how often AI materially contributed to either finding flaws or developing attacks.
Source: ThorstenMeyerAI.com
