Record CVEs, Crypto Losses And AI: A Black October 2026 Recap

🔍 Read the full analysis: Record CVEs, Crypto Losses And AI: A Black October 2026 Recap on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

A November 1 review of October 2026 reported 17,060 new CVE records in the U.S. National Vulnerability Database, 36 additions to the federal list of vulnerabilities known to be exploited, and $3.47 billion in crypto losses after frozen and returned funds were accounted for. The figures mark different measures of security activity, and the review’s own comparisons show that vulnerability disclosures grew far faster than documented exploitation.

The review’s author, Thorsten Meyer, says the NVD figure is based on records published in October, counted through the NVD API on the morning of November 1, with rejected records excluded. The October total was four times the 4,273 records counted for October 2025. From January through October, the review counted 89,859 records in 2026, compared with 39,639 in the same period in 2025. Those are publication counts, not counts of attacks or proof that every listed flaw is dangerous in practice.

The exploitation measure rose more slowly. CISA added 36 flaws to its Known Exploited Vulnerabilities catalog in October, up from 31 in October 2025. The agency’s catalog contained 282 additions for January through October 2026, compared with 245 additions across all of 2025. A catalog entry indicates evidence of exploitation, but the addition totals do not provide a complete count of attacks or affected systems.

For crypto losses, the review cites CertiK’s $3.47 billion October estimate after frozen and returned funds, against $68 million in October 2025. It says Binance accounted for 96.7% of October’s figure and that the FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31. The source describes more than $6 billion leaving Binance in one evening on October 29; the relationship between that amount and CertiK’s net loss estimate is not fully explained in the supplied material.

Disclosures Outpaced Known Exploitation

The main reporting takeaway is that more published vulnerabilities do not automatically mean more attacks. October’s CVE count quadrupled year over year, while CISA’s monthly additions rose from 31 to 36. These datasets measure different stages: public documentation of flaws versus vulnerabilities for which CISA cites evidence of exploitation. Treating the CVE surge as a direct measure of active attacks would overstate what the figures establish.

Still, the exploitation figures point to sustained pressure on defenders. CISA’s catalog additions for the first ten months of 2026 had already exceeded the full-year 2025 count, and the review lists flaws affecting remote-access products, firewalls, collaboration software and infrastructure. Organizations need to distinguish a large disclosure queue from the smaller set of flaws known to be used by attackers, while tracking both.

The crypto figure describes a different kind of risk: reported financial losses can be concentrated in a single event. The review says Binance represented nearly all of CertiK’s monthly total and reports the FBI’s attribution to North Korea. That makes the attribution and the calculation method important; the summary alone does not establish how much was permanently lost or recovered after the estimate was made.

Products Worth Considering

Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black

AmazonView Latest Price

Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver

AmazonView Latest Price

Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Three Measures, Different Evidence

Meyer frames the month through three separate ledgers: disclosed vulnerabilities, known exploitation and stolen crypto. A CVE is a public record that a vulnerability exists. CISA’s KEV catalog is a narrower list of flaws with reliable evidence of active exploitation. Crypto-loss estimates, meanwhile, are based on incidents and asset movements and can change when funds are frozen or returned. Comparing their totals as though they counted the same event would be misleading.

The review reports that October’s NVD count was 3,564 in 2024, 4,273 in 2025 and 17,060 in 2026. It also notes that including rejected records would raise the 2026 October count to 17,481. Google’s threat intelligence group has cautioned that automated assignment practices can inflate CVE totals; the review says Linux-kernel descriptions accounted for about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation among those records. The supplied source ends partway through its account of Google’s broader exploitation analysis, so its full methodology and findings are not available here.

On AI, the author reports that at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including one flaw already exploited in the wild. The review says PHP flaws dubbed PHP2Shell were patched on October 21 after being found through OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. These examples support a role for AI in vulnerability discovery and repair; they do not show that AI caused the CVE spike or the Binance theft.

“Some of it supports my view. Some of it does not.”

— Thorsten Meyer, author of the October review

Attribution and Totals Need Caveats

The figures do not settle whether October was a record month for hacking overall. CVE publication totals are not attack totals, and CISA’s KEV additions capture only vulnerabilities added to that catalog, not every exploited flaw. The review says Google’s threat intelligence group found exploitation rising roughly in step with disclosure and estimated that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The supplied material does not provide the full study details needed to assess the estimate or its scope.

The crypto accounting also needs clarification. The source cites more than $6 billion leaving Binance on October 29 while reporting $3.47 billion in monthly losses after frozen and returned funds. It does not explain whether those amounts use different definitions, cover different assets, or refer to separate stages of the same incident. The FBI attribution is reported by Meyer, but the supplied source does not include a direct FBI document or Binance’s account of the incident.

Finally, the review’s AI examples show credited research and patching activity, not a measured causal link between AI and October’s records. Meyer argues that attackers can turn fixes into exploits within days and says an embargo on PHP2Shell broke before release. The material provided does not detail the timeline or evidence for that claim. His prediction of more major vulnerabilities and AI-assisted attacks is identified as his view, not a measurement.

Track Catalog Updates and Incident Findings

The next useful checks are updates to CISA’s KEV catalog, further reporting on the Binance incident, and revised crypto-loss estimates as funds are traced or recovered. The October figures are a snapshot: the review used the NVD API on November 1 and cites the KEV catalog version dated October 30, so later record changes could affect comparisons.

Security teams can use the catalog additions to prioritize vulnerabilities with reported exploitation, while checking vendor advisories and their own exposure. For the broader AI claim, evidence will depend on documented discovery and patch timelines, and on whether later reporting distinguishes AI-assisted vulnerability research from AI use by attackers. The supplied material does not identify a scheduled investigation, release or follow-up date.

Key Questions

What records did October 2026 set, according to the review?

The review reports 17,060 new NVD CVE records and 36 October additions to CISA’s Known Exploited Vulnerabilities catalog. It also cites $3.47 billion in crypto losses after frozen and returned funds, based on CertiK’s estimate. These measures have different definitions and should not be treated as one combined count of attacks.

Does the record CVE count mean attacks quadrupled?

No. The CVE total was four times October 2025’s count, but it measures published vulnerability records, not attacks. CISA’s KEV additions rose from 31 to 36 year over year, a much smaller increase.

What does the review say about Binance and the reported crypto losses?

It says CertiK estimated $3.47 billion in October losses after frozen and returned funds, and that Binance accounted for 96.7% of the total. It also reports the FBI attributed the Binance theft to North Korea’s TraderTraitor. The supplied material does not reconcile the estimate with its separate statement that more than $6 billion left Binance in one evening.

Did AI cause the October security records or Binance theft?

The review does not establish that. It describes AI-linked vulnerability research and patching, including work credited in Microsoft’s October security release and OpenAI’s Patch the Planet program. The author’s wider claim about AI-assisted attacks is a thesis, not a measured finding, and the source says the Binance theft began with a compromised laptop rather than an AI-found flaw.

Source: ThorstenMeyerAI.com