🔍 Read the full analysis: Record CVEs, A $6 Billion Crypto Heist And The AI Fight In Black October on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
October 2026 set a monthly record with 17,060 published CVE records, while CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. CertiK estimated $3.47 billion in crypto losses, largely tied to a Binance theft the FBI attributed to North Korea; AI tools also received credit for finding software flaws, but the figures do not show that AI caused the month’s wider rise in attacks.
October 2026 brought 17,060 newly published CVE records, a monthly high, and an estimated $3.47 billion in cryptocurrency losses, according to figures compiled by Thorsten Meyer and CertiK. The record disclosures did not translate into a comparable jump in flaws confirmed as exploited: CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog during the month.
Meyer’s count, based on a query of the U.S. National Vulnerability Database API on November 1 and excluding rejected records, found October’s CVE total was four times October 2025’s 4,273. From January through October, the count reached 89,859, compared with 39,639 over the same period in 2025. The source notes that including rejected records would put October’s total at 17,481, so the method affects the headline number.
CISA added 36 entries to its KEV catalog in October, compared with 31 in October 2025 and 17 in October 2024. Its 282 additions through October 2026 already exceeded the 245 added during all of 2025. These counts describe catalog additions, not every attempted or successful intrusion. The source also reports Google Threat Intelligence Group’s estimate that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited.
CertiK’s estimate put October’s crypto losses at $3.47 billion after frozen and returned funds, versus $68 million in October 2025. The source says Binance represented 96.7% of October’s total and that the FBI attributed the Binance theft to North Korea’s TraderTraitor group on October 31. It also says Microsoft’s October security release credited an AI model or AI vulnerability research firm in at least 65 entries, including one flaw exploited in the wild; the PHP flaws known as PHP2Shell were attributed to OpenAI’s Patch the Planet program.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The numbers describe different parts of the security picture and should not be treated as interchangeable. CVE disclosures count public vulnerability records; CISA’s KEV additions represent flaws for which it has evidence of exploitation; crypto-loss estimates track stolen funds. October’s data show a sharp rise in disclosures and losses, but a much smaller year-over-year increase in monthly KEV additions.
That distinction matters for organizations deciding what to patch first. A record CVE total does not mean every newly listed issue is being used against systems. The source highlights exposed remote-access, firewall, collaboration, and infrastructure products among October’s KEV entries, making verified exploitation evidence and an organization’s own exposure more useful guides than the raw disclosure count alone.
The AI findings add evidence that automated systems are contributing to vulnerability research and remediation, but they do not establish that AI caused the CVE surge or the Binance loss. Meyer’s own interpretation is mixed: he argues that AI can help attackers turn fixes into exploits quickly, while also noting that most disclosures were not seen exploited and that the Binance incident reportedly began with a compromised laptop rather than an AI-discovered vulnerability.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
The source frames October through three measures: disclosed, exploited, and stolen. A CVE record is a public entry about a vulnerability; its publication alone does not prove attackers have used it. CISA’s KEV catalog is narrower, listing vulnerabilities for which the agency has reliable evidence of active exploitation. Crypto-loss estimates are a separate measure based on reported thefts and subsequent fund recoveries.
The figures also depend on counting choices. Meyer queried the NVD by publication date and excluded rejected records, while the source says automated assignment practices and large batches of records can raise totals without showing equivalent growth in real-world exploitation. Google Threat Intelligence Group was cited as finding that some high-volume CVE categories had no observed zero-day exploitation during the period it examined.
For AI-related findings, the source points to Microsoft’s October security acknowledgments and Google’s Big Sleep project. It reports that Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. Those examples show AI’s role in vulnerability research, but they are not evidence that AI discovered every October flaw or drove the month’s overall totals.
“The FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31.”
— The FBI, as reported by Meyer
Attribution and AI’s Role
The supplied material does not provide a detailed account of the Binance incident, the evidence behind the FBI’s attribution, or a breakdown of how the reported funds were taken. The $3.47 billion estimate is attributed to CertiK and is stated after frozen and returned funds; the source says Binance accounts for 96.7% of the monthly figure. The exact composition of the remaining losses is not set out.
It is also unclear how much of October’s CVE increase reflects more underlying vulnerabilities, changes in reporting or numbering practices, or other factors. The analysis offers caveats about automated assignments and counting methods but does not establish the cause of the surge. Its claim that attackers use AI to turn fixes into exploits within days is presented as Meyer’s interpretation, not as a measured finding for all attacks.
The material describes selected AI-assisted research and patching cases, not a complete audit of AI’s role across October’s security incidents. It does not show that AI caused the Binance theft or that the presence of an AI credit in a security release means an AI system independently found or fixed each credited flaw.
Watch Patches and Investigation Updates
Security teams will need to track new evidence in CISA’s KEV catalog and prioritize applicable vulnerabilities in exposed products. October’s catalog additions include flaws affecting remote-access gateways, firewalls, support tools, and widely used software, according to Meyer’s review. The next practical signal is whether additional disclosed vulnerabilities receive confirmed exploitation evidence and whether vendors publish further fixes or guidance.
Further updates from the FBI, Binance, or other investigators could clarify the theft’s scope, attribution, and recovery status. The source does not state that a new announcement or investigation milestone is scheduled. Separately, later NVD counts and security disclosures may show whether October’s CVE record was a one-month spike or part of a continuing pattern. For now, the evidence supports a record month for disclosures and reported crypto losses, but not a conclusion that AI drove a general surge in successful attacks.
Key Questions
How many CVEs were published in October 2026?
Meyer counted 17,060 new NVD CVE records by publication date, excluding rejected records. The source says the count would be 17,481 if rejected records were included.
Did confirmed exploitation rise at the same rate as CVE disclosures?
No. CISA added 36 vulnerabilities to KEV in October, up from 31 in October 2025, while the monthly CVE count rose from 4,273 to 17,060. These measures track different things, and catalog additions do not represent every attack.
What does the source say about the Binance theft?
The source reports CertiK’s estimate that October crypto losses totaled $3.47 billion after frozen and returned funds, with Binance accounting for 96.7%. It says the FBI attributed the Binance theft to North Korea’s TraderTraitor group on October 31; further details are not included in the supplied material.
Does October’s data prove AI caused more cyberattacks?
No. The analysis reports AI-related vulnerability research and patching examples, while also saying most disclosed vulnerabilities were not observed exploited. It presents AI’s role in attackers’ use of fixes as Meyer’s view, not as a demonstrated cause of the month’s record disclosures or crypto losses.
Source: ThorstenMeyerAI.com
