🔍 Read the full analysis: Black October 2026, Episode One: Tracking AI Across The Cybersecurity Fight on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Thorsten Meyer’s November 1 report describes October 2026 as a record month for vulnerability disclosures, with 17,060 new CVE records counted by the author, while CISA added 36 flaws to its Known Exploited Vulnerabilities catalog. The report also cites AI-linked vulnerability research and fixes, and a $3.47 billion estimate of crypto losses, most of it attributed to the Binance theft. Its figures and interpretations come from the source’s analysis; the material does not establish that AI caused the month’s broader rise in attacks or losses.
Meyer says he queried the National Vulnerability Database API on November 1, counting records by publication date and excluding rejected entries. On that basis, October’s 17,060 records were up from 4,273 in October 2025 and 3,564 in October 2024. For January through October, his count was 89,859 CVEs in 2026, compared with 39,639 in the same period in 2025. He says including rejected records would put the October 2026 figure at 17,481.
The exploitation figures were lower and rose less sharply. The report says CISA added 36 vulnerabilities to KEV in October, compared with 31 in October 2025 and 17 in October 2024. CISA’s catalog version dated October 30 showed 282 additions in 2026 through that date, already more than the 245 added during all of 2025. Five October additions involved older vulnerabilities, dated from 2015 to 2023, for which new evidence of exploitation had emerged.
For crypto losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses, net of funds frozen or returned, versus $68 million in October 2025. The report attributes 96.7% of October’s total to Binance. It says the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. The source does not provide further detail on the FBI’s public attribution or the incident’s technical findings.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Is Not the Same as Exploitation
The report’s central point is that security disclosures, confirmed exploitation and financial theft are separate indicators. October’s CVE count rose far faster than CISA’s KEV additions. That difference matters to organizations prioritizing remediation: the number of published flaws alone does not show which ones attackers are using, though the KEV list is also not a complete account of every attack.
The data also frame a question about AI’s place in security work. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. He identifies PHP2Shell, patched October 21, as work from OpenAI’s Patch the Planet program, and says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show AI-linked research and fixes, but do not establish that AI drove October’s overall CVE increase or the Binance theft.
For defenders, the practical implication is to assess vulnerabilities by exposure and evidence of exploitation, not publication totals alone. Meyer also says attackers can use AI to turn fixes into exploits quickly; that is his interpretation, and the supplied material does not quantify the scale or frequency of AI-assisted exploitation.
Popular right now
De'Longhi 15-Bar Pump Espresso Machine with Milk Frother & Temperature Control
TCL QM64L 85-Inch QD-Mini LED 4K Smart Fire TV
Dyson Airwrap i.d. Multi-Styler for Straight and Wavy Hair
As an affiliate, we earn on qualifying purchases.
Three Measures Behind October’s Records
Meyer separates the month into three “ledgers”: disclosed flaws, flaws with evidence of active exploitation, and reported crypto theft. A CVE record documents a vulnerability; it is not itself proof that attackers have used it. CISA’s KEV catalog tracks vulnerabilities for which the agency says reliable evidence of exploitation exists. Crypto-loss estimates measure a different outcome and should not be treated as a count of cyberattacks generally.
The report cites Google’s Threat Intelligence Group (GTIG), which said exploitation had risen roughly in step with disclosure and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. Meyer also cites GTIG’s September 30 figures: 141 distinct vulnerabilities disclosed and exploited from January through August 2026, compared with 127 during all of 2025. He says monthly zero-day counts rose modestly, from an average of eight to 11, though the supplied material gives limited detail on the calculation.
Meyer notes that CVE totals can be affected by assignment and reporting practices. He cites GTIG’s observation that descriptions mentioning the Linux kernel accounted for about 5,000 CVEs from January through August 2026, with no observed zero-day exploitation of those entries. This caveat helps explain why a sharp increase in published records cannot, by itself, be read as a matching increase in real-world attacks.
““The haystack grew much faster than the needles.””
— Thorsten Meyer, describing the CVE and KEV comparison
AI’s Role Remains Unquantified
The source offers examples of AI-associated security research and remediation, but it does not establish how much AI contributed to the CVE record, the number of exploited flaws or October’s crypto losses. Its claim that attackers can turn fixes into exploits within days is presented as Meyer’s assessment; the material supplies no month-wide dataset measuring AI-assisted exploit development.
The totals also have defined limits. Meyer’s CVE count is an author’s API query with rejected records excluded, while the CISA figure is based on a catalog snapshot dated October 30. The report cites CertiK’s net crypto-loss estimate but does not provide a breakdown of the underlying incidents beyond Binance’s reported share. The source’s stated Binance attribution is attributed to the FBI, but details of the public evidence and the theft’s technical path are not included here.
There is also an unresolved tension in the report’s account: disclosure volume rose dramatically, while the cited exploitation indicators rose more modestly. The available figures do not show whether later exploitation will change that comparison or how much the increase reflects changes in vulnerability reporting practices.
Watch KEV Updates and Incident Findings
The immediate next step is to track whether CISA adds further October vulnerabilities to KEV and whether subsequent evidence changes the picture of active exploitation. Security teams can use the catalog’s additions as one prioritization signal while checking whether listed software is present and exposed in their own environments.
Further technical and official reporting would help clarify the Binance incident, including the evidence behind the attribution cited by Meyer and the role of the compromised laptop. More detailed reporting on AI-linked vulnerability findings and exploit development would also be needed to test the article’s thesis beyond individual examples. Meyer’s accompanying video is described as a five-minute presentation of the three ledgers and the evidence behind his assessment.
Key Questions
What is the main development in the report?
Thorsten Meyer’s November 1 analysis compares October 2026 CVE disclosures, CISA KEV additions and crypto-loss estimates, while examining examples of AI-linked vulnerability research and fixes.
How many vulnerabilities were disclosed in October?
Meyer counted 17,060 new NVD CVE records for October 2026, excluding rejected records. He says the figure would be 17,481 if rejected records were included; it is his count using the NVD API, not a count of flaws known to be exploited.
Did the number of exploited vulnerabilities rise as quickly as disclosures?
No, not in the October comparison given. Meyer reports 36 CISA KEV additions in October 2026, up from 31 a year earlier, while CVE disclosures rose from 4,273 to 17,060. These measures have different definitions, and KEV additions are not a complete count of all exploitation.
What does the report say about AI and security fixes?
It says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, and identifies PHP2Shell as work associated with OpenAI’s Patch the Planet program. The report does not show that AI caused the overall rise in disclosures or the month’s largest theft.
What remains unknown about October’s crypto losses?
The source cites CertiK’s estimate of $3.47 billion in net October losses and says Binance accounted for 96.7%. It attributes the Binance theft to North Korea’s TraderTraitor based on an FBI attribution, but does not include the underlying technical evidence or a detailed incident account.
Source: ThorstenMeyerAI.com
