🔍 Read the full analysis: Black October 2026, Episode One: Record CVEs, A $6 Billion Crypto Heist And AI On Both Sides Of The Fight on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The National Vulnerability Database recorded 17,060 new CVEs in October, while CISA added 36 vulnerabilities to its actively exploited catalog. CertiK counted $3.47 billion in crypto losses after frozen and returned funds; the FBI attributed the Binance theft to North Korea’s TraderTraitor. The source argues AI helped find flaws and speed exploit development, but the evidence does not show that AI caused the month’s disclosure surge or the Binance theft.
October 2026 brought 17,060 newly published CVE records and $3.47 billion in reported crypto losses, according to figures compiled by Thorsten Meyer from the U.S. National Vulnerability Database and CertiK. The month also saw 36 additions to CISA’s Known Exploited Vulnerabilities catalog, a smaller increase than the jump in disclosures; the FBI attributed the Binance theft to North Korea’s TraderTraitor.
Meyer’s NVD API count, taken on November 1, excludes rejected records and counts vulnerabilities by publication date. It found 17,060 CVEs published in October, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count reached 89,859, against 39,639 in the same period of 2025. Including rejected records would put October 2026 at 17,481, the source says.
Those disclosure totals are not a count of attacks. CISA added 36 vulnerabilities to KEV in October, where entries require evidence of exploitation, compared with 31 in October 2025 and 17 in 2024. The year-to-date total reached 282 by October 30, already above the 245 additions recorded across all of 2025. Five of October’s additions were older flaws, dated from 2015 to 2023, for which new exploitation evidence had emerged.
CertiK’s October estimate was $3.47 billion in crypto losses after accounting for funds frozen or returned, compared with $68 million in October 2025. Meyer says the Binance incident accounted for 96.7% of that month’s total. On October 31, the FBI attributed the theft to North Korea’s TraderTraitor. The supplied source does not give further independently verifiable detail about the incident’s mechanics.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The gap between published flaws and documented exploitation is the central finding in Meyer’s comparison. CISA’s 36 October additions were up about 16% from a year earlier, while the NVD’s monthly publication count was roughly four times its October 2025 level. A large disclosure count can mean more vulnerabilities are being reported or assigned records; it does not mean attackers are exploiting all of them.
The distinction affects how organizations interpret security alerts. A CVE describes a publicly recorded vulnerability; a KEV entry indicates evidence of active exploitation and can help defenders prioritize patching. Meyer cites Google’s threat intelligence group as estimating that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The source also says zero-day activity rose moderately, from an average of eight to 11 a month. These measures point to increased activity, but not a one-for-one conversion of disclosures into attacks.
The crypto figure presents a separate risk signal: losses can concentrate in one major incident rather than track vulnerability disclosures. The FBI’s attribution identifies the group it says was responsible for the Binance theft, but does not establish that AI played a role. No causal link between AI and the heist is demonstrated in the material provided.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
Ledger Nano X Bluetooth Crypto Wallet
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames the month through three separate measures: disclosures, exploited vulnerabilities and stolen crypto. They capture different events and use different methods. NVD publication totals count public records, CISA’s KEV catalog tracks flaws with reliable evidence of exploitation, and crypto-loss estimates are based on incidents and adjustments such as returned or frozen funds. They should not be combined into a single measure of cyber risk.
The NVD count also depends on how records are handled. Meyer excludes rejected entries and cautions that CVE identifiers themselves are not equivalent to published vulnerabilities: numbering authorities may reserve large blocks of IDs. He cites Google’s threat intelligence group saying automated assignment policies can inflate totals. The group reportedly counted about 5,000 Linux-kernel-related CVEs from January to August 2026, with no observed zero-day exploitation among them. That example illustrates why record volume alone cannot establish increased attacker activity.
The source also points to AI-related vulnerability research during the month. It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It says PHP2Shell flaws were patched on October 21 after emerging from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. Those are reported program and vendor findings, not evidence that AI caused October’s overall record counts.
“Some of it supports my view. Some of it does not.”
— Thorsten Meyer, describing his thesis
What the October Totals Cannot Show
The figures do not establish that AI caused the CVE surge, that the majority of disclosed vulnerabilities were exploited, or that AI was involved in the Binance theft. Meyer’s claim that attackers are using AI to turn fixes into exploits within days is presented as his assessment; the provided material does not include a complete case-by-case dataset to measure how often this happened.
Some comparisons also depend on definitions and sources. The NVD totals reflect Meyer’s API query and exclusion of rejected records, while the crypto estimate depends on CertiK’s accounting after frozen and returned funds. The source does not provide a detailed breakdown of the Binance incident or independent documentation for every AI-related research credit it cites. Its truncated discussion of Google threat intelligence data also leaves some figures and qualifications incomplete.
It remains unclear whether October’s disclosure and loss records will persist in later data revisions, how many of the month’s reported AI-found flaws were exploited, and what share of the crypto losses can be tied to particular methods. Disclosure, exploitation and attribution remain distinct questions in the evidence presented.
Follow Patches and Exploitation Evidence
The next useful checkpoints are updates to CISA’s KEV catalog, further technical reporting on the October incidents, and any revised NVD or CertiK totals. New KEV additions would show which disclosed flaws later gained evidence of active exploitation; changes to crypto-loss estimates could alter the month’s reported total.
For the AI claims, the relevant follow-up is documentation linking particular research tools to identified vulnerabilities, published fixes and any subsequent exploitation. Meyer’s report says fixes for some AI-associated flaws shipped during October, including the PHP2Shell patches dated October 21, but the supplied material does not establish a broader timeline for the other cases.
The FBI’s attribution of the Binance theft is the current official position described in the source. Further public statements or investigative findings may add detail about the incident and the basis for that attribution. Until then, the record supports a month of sharply increased vulnerability disclosures and substantial crypto losses, but not a single explanation linking them.
Key Questions
How many CVEs were published in October 2026?
Meyer’s count from the NVD API was 17,060, excluding rejected records. He says the figure would be 17,481 if rejected records were included.
Did the number of actively exploited vulnerabilities rise at the same rate?
No. CISA added 36 vulnerabilities to KEV in October 2026, compared with 31 in October 2025. That was a smaller increase than the rise in published CVE records, and the two measures track different things.
How much crypto was lost in October?
CertiK’s estimate cited by Meyer was $3.47 billion after frozen and returned funds. The source says the Binance theft represented 96.7% of the monthly total.
Who did the FBI say was behind the Binance theft?
Meyer’s report says the FBI attributed the theft to North Korea’s TraderTraitor on October 31. The supplied source does not include further details about the FBI’s evidence or the theft’s mechanics.
Does the report show that AI caused the records or the heist?
No. It cites AI-associated vulnerability research and argues that AI may help attackers develop exploits quickly, but it does not establish that AI caused the CVE increase or the Binance theft.
Source: ThorstenMeyerAI.com
