🔍 Read the full analysis: Black October 2026, Episode One: Record CVEs, A $6 Billion Crypto Heist And AI On Both Sides Of The Fight on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Thorsten Meyer’s November 1 analysis reports 17,060 CVE records published in October 2026 and a Binance theft valued at more than $6 billion, attributed by the FBI to North Korea. The figures show disclosures rising much faster than flaws added to CISA’s exploited-vulnerability catalog; the article’s evidence for AI’s role is mixed.
October 2026 saw 17,060 new CVE records published in the U.S. National Vulnerability Database and a cryptocurrency theft from Binance valued at more than $6 billion, according to an analysis by Thorsten Meyer. The FBI attributed the theft to North Korea on October 31, while the month’s vulnerability figures show disclosure growth far outpacing additions to the U.S. government’s catalog of flaws known to be exploited.
Meyer says his count of NVD records, based on an API query on November 1 and excluding rejected records, puts October’s total at 17,060, compared with 4,273 in October 2025. From January through October, the count was 89,859, against 39,639 in the same period a year earlier. The source notes that including rejected records would raise the October 2026 figure to 17,481, illustrating that totals depend on counting method.
The exploitation figures rose less sharply. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. There were 282 additions from January through October 2026, exceeding the 245 added over all of 2025. The catalog is intended to list vulnerabilities with evidence of active exploitation; its additions are not a complete count of all attacks.
On cryptocurrency losses, Meyer cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds were accounted for, compared with $68 million in October 2025. The analysis says the Binance incident represented 96.7% of the month’s total and reports that the FBI attributed it to North Korea’s “TraderTraitor” group. The article also identifies AI-related security work: at least 65 entries in Microsoft’s October security release credit an AI model or an AI vulnerability research firm, including one flaw reported as exploited in the wild.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaces Exploitation
The figures point to two different security pressures: a rapidly expanding pool of disclosed flaws and a smaller, though growing, set with documented exploitation. In Meyer’s comparison, October CVE disclosures rose to roughly four times their October 2025 level, while CISA’s monthly KEV additions rose by 16%. That difference matters to defenders: a raw disclosure count is not a direct measure of attacks, and it does not tell organizations which vulnerabilities are being used against them.
The analysis cites Google Threat Intelligence Group’s estimate that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. It also reports that exploitation rose roughly in step with disclosure in GTIG’s broader assessment. The two measures use different methods and periods, so they should not be treated as interchangeable. Together, they caution against reading the CVE record alone as proof that attacks have multiplied at the same rate.
The Binance incident gives the month a separate financial dimension. A theft of this scale can affect customers, market confidence and the security practices of major exchanges. But Meyer’s account says the incident began with a compromised laptop, not an AI-discovered vulnerability. That distinction limits what the heist can show about AI’s role in cybercrime, even as the article documents AI involvement in vulnerability research and patching.
Products Worth Considering
Bose SoundLink Plus Portable Bluetooth Speaker, Black
Bose SoundLink Max Bluetooth Speaker
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Three Different Security Measures
Meyer frames the month through three ledgers: disclosed vulnerabilities, vulnerabilities with evidence of exploitation, and cryptocurrency losses. A CVE record indicates that a vulnerability has been publicly documented; it does not by itself establish that attackers have used it. CISA’s KEV catalog tracks flaws for which the agency has reliable evidence of active exploitation. Crypto-loss estimates track a different outcome and may change as funds are frozen or returned.
The NVD count is Meyer’s calculation from the NVD API, using publication dates and excluding rejected records. He warns that automated assignment practices can inflate totals. As one example, the analysis cites GTIG’s finding that descriptions mentioning the Linux kernel generated about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation among those records. A high volume of entries can reflect how flaws are identified and recorded, not just a sudden increase in attacker activity.
AI’s contribution is also presented as a developing area rather than a single explanation for October’s events. Meyer says PHP flaws dubbed PHP2Shell were connected to OpenAI’s Patch the Planet program and patched on October 21. He also cites Google’s report that its Big Sleep system found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples concern vulnerability discovery and repair; they do not establish that AI caused the month’s overall increase in disclosures or the Binance theft.
““The haystack grew much faster than the needles.””
— Thorsten Meyer, describing the October figures
AI’s Role Remains Unsettled
The available figures do not establish that AI caused the CVE record, a broader increase in attacks, or the Binance theft. Meyer argues that attackers can use AI to turn fixes into exploits within days and says the PHP2Shell embargo broke before release. Those are claims in his analysis; the supplied material does not provide independent evidence quantifying how often AI was used to develop or deploy exploits during October.
Other limitations remain. NVD totals vary with the counting method, and the source itself notes that many published entries may not correspond to observed exploitation. CertiK’s October loss figure is given after frozen and returned funds, but the material does not explain the incident-level calculation in detail. The supplied account also does not provide a full technical description of the Binance compromise, the amount of funds recovered, or the exchange’s response.
The source material ends partway through its discussion of GTIG’s exploitation trend, so that section’s complete figures and qualifications are not available here. It is also unclear from the supplied information how many of Microsoft’s credited October entries were directly produced by AI models, rather than by research firms using AI-related methods.
Follow-Ups on Attribution and Patching
Further reporting should clarify the Binance incident’s investigation, the amount of cryptocurrency recovered, and what security changes the exchange has made. The FBI attribution reported by Meyer is a key development, but the supplied source does not include the FBI’s underlying evidence or a detailed public account of the compromise.
For vulnerability trends, the next useful updates will be comparable NVD and CISA figures for later months, with counting methods stated clearly. Security teams can use CISA’s KEV additions to prioritize flaws with documented exploitation, while treating the larger CVE total as a measure of disclosure activity rather than a direct attack count.
AI claims will require case-level evidence: which tools found a flaw, whether attackers used AI to exploit it, and how quickly a patch or exploit followed. Meyer’s analysis offers examples of AI-assisted discovery and argues that attackers are adapting quickly, but the evidence presented does not settle how much AI changed the overall threat picture in October.
Key Questions
How many CVEs were published in October 2026?
Meyer counted 17,060 NVD records published in October, excluding rejected records. Including rejected records would raise his count to 17,481.
Does the CVE record mean attacks increased fourfold?
No. The CVE count measures disclosed records, not attacks. CISA added 36 vulnerabilities to its KEV catalog in October, compared with 31 in October 2025; those measures track different things.
Who was blamed for the Binance theft?
Meyer’s analysis says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The supplied material does not include the FBI’s supporting evidence or a full technical account.
Did AI cause the Binance theft?
The source does not say that. Meyer reports that the theft began with a compromised laptop and presents AI’s role in the incident as unproven.
What evidence links AI to October’s security work?
The analysis says Microsoft’s October security release credited an AI model or AI vulnerability research firm in at least 65 entries. It also cites OpenAI’s Patch the Planet program in connection with PHP2Shell and Google’s report on its Big Sleep research system. These examples do not establish AI’s role in the month’s overall attack totals.
Source: ThorstenMeyerAI.com
