🔍 Read the full analysis: What Did AI Have To Do With Black October 2026? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
October 2026 saw record numbers of published vulnerability records and more than $6 billion reportedly stolen from Binance, while CISA added 36 flaws to its actively exploited catalog. The source documents AI involvement in vulnerability research and says attackers can use AI to turn fixes into exploits quickly, but it does not show that AI caused the month’s overall spike or the Binance theft.
October 2026 set records for published vulnerability disclosures and reported cryptocurrency losses, but available figures do not establish that artificial intelligence caused a general rise in successful attacks. In an analysis published November 1, Thorsten Meyer separates disclosure, confirmed exploitation and theft, pointing to documented AI-assisted bug research while noting that exploitation grew far more slowly than disclosures.
Meyer’s count of National Vulnerability Database records, queried through its API and excluding rejected records, found 17,060 new CVE records in October, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the count reached 89,859, against 39,639 in the same period of 2025. The source says the totals depend on counting method: including rejected records would put October 2026 at 17,481.
A separate measure gives a more limited rise in known exploitation. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. Its additions for 2026 had reached 282 by October 30, already above the 245 added during all of 2025. These figures track catalog additions, not every attack or every vulnerability exploited.
The source also cites CertiK’s estimate of $3.47 billion in October crypto losses after frozen and returned funds were accounted for, compared with $68 million in October 2025. It says Binance represented 96.7% of the month’s losses and that the FBI attributed the Binance theft to North Korea’s “TraderTraitor” on October 31. The source describes more than $6 billion leaving Binance in one evening, but does not reconcile that figure with CertiK’s adjusted monthly loss total.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Disclosure Records Don’t Equal Attacks
The distinction between vulnerabilities being recorded and attackers exploiting them matters to security teams and the public. A surge in CVEs is not, by itself, evidence of a matching surge in successful attacks: the source reports that October’s CVE count quadrupled year over year, while CISA’s monthly additions to KEV rose from 31 to 36.
That gap complicates claims that AI has already transformed the scale of cyberattacks. More reported flaws can reflect changes in discovery, reporting or assignment practices, as well as newly found security weaknesses. Defenders need to prioritize evidence of exploitation and the specific systems affected, rather than treating every new record as an active attack.
At the same time, AI-assisted research and faster exploit development could shorten the period between disclosure and risk to users. Meyer argues that attackers can use AI to turn fixes into exploits within days. The article’s cited examples make that a concern worth tracking, but they do not quantify how often AI was used or demonstrate that it drove October’s broader totals.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
Three Measures Behind October’s Records
Meyer organizes the month’s evidence into three categories: disclosed vulnerabilities, flaws with evidence of exploitation, and reported crypto losses. They measure different events. A CVE is a public record that a vulnerability exists; a KEV entry reflects CISA’s inclusion of a flaw for which it has reliable evidence of exploitation. Crypto-loss estimates measure a separate financial impact and may change when funds are frozen or returned.
The source says Google’s Threat Intelligence Group found 141 distinct vulnerabilities disclosed and exploited from January through August 2026, more than the 127 it counted for all of 2025. It also cautions that automated assignment practices can inflate disclosure totals: the group identified about 5,000 Linux-kernel-related CVEs from January to August, with no observed zero-day exploitation in that category. The source reports zero-days averaging 11 a month in 2026, up from eight, a more moderate increase than the CVE count.
There are examples of AI’s role in defensive research. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or AI vulnerability research firm, including a flaw already exploited in the wild. The PHP2Shell vulnerabilities, patched October 21, came from OpenAI’s Patch the Planet program, according to the source. Google’s Big Sleep, it adds, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. These examples show research activity, not that AI caused the month’s record attack totals.
“That is my view, not a measurement.”
— Thorsten Meyer, describing his own view
What the October Data Cannot Show
The figures do not establish how much of October’s activity was caused or enabled by AI. The source provides examples of AI-assisted security research and a claim that attackers can use AI to develop exploits quickly, but it gives no count of attacks in which AI was used, no comparison with attacks without AI, and no method for attributing the month’s overall totals to the technology.
The source also reports that PHP2Shell’s embargo broke before its planned release and says attackers use AI to turn fixes into exploits within days. It does not provide a detailed timeline or evidence tying a particular AI-generated exploit to a specific attack in this material. Similarly, the supplied account says the Binance theft began with a compromised laptop rather than an AI-found vulnerability; it does not explain the full intrusion or establish whether AI played any role elsewhere.
Crypto-loss figures also require care: the stated amount leaving Binance in a single evening exceeds CertiK’s adjusted estimate for October losses. The source does not reconcile the different totals or give enough detail here to independently assess their calculation. Its claim that the FBI attributed the theft to North Korea’s “TraderTraitor” is an attributed official assessment, not evidence that AI was involved.
Evidence to Watch in Upcoming Reports
The next useful test is whether later reporting can connect AI use to specific, verified incidents rather than inferring a cause from monthly totals. That would require dated evidence about when a vulnerability was disclosed, when an exploit appeared, whether AI tools were used, and how the flaw was used in an attack.
Security teams will also need to track whether CISA’s KEV additions continue rising and whether the October disclosure spike persists under consistent counting rules. The source’s NVD figures are a snapshot queried on November 1, while catalog additions and vulnerability records can be revised. The Binance theft attribution and the reported loss estimates may also receive further detail from investigators and the companies involved.
For now, the best-supported conclusion is narrower than the phrase “AI-powered hacking wave” suggests: AI is being used in vulnerability research, and the source raises concerns about faster exploit development, but October’s record disclosures and theft totals do not prove that AI drove a broad increase in successful attacks.
Key Questions
What does “Black October 2026” refer to?
It is Meyer’s label for October 2026, a month in which his analysis found record CVE disclosures, rising CISA KEV additions and very large reported crypto losses. The label is the author’s framing, not an official designation.
Did AI cause the October 2026 rise in cyberattacks?
The available material does not establish that. It documents AI-assisted vulnerability research and raises the possibility that AI can help attackers develop exploits more quickly, but it does not measure AI’s share of attacks or link it to the overall monthly totals.
How many vulnerabilities did CISA add to its exploited-flaws catalog?
CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October 2026, according to the source, compared with 31 in October 2025 and 17 in October 2024. Those are catalog additions, not a count of all attacks.
What is the difference between a CVE and a KEV entry?
A CVE is a public record identifying a vulnerability. A CISA KEV entry indicates that the agency has reliable evidence the vulnerability is being exploited. A rise in CVE records does not mean every flaw is being attacked.
What is known about the Binance theft?
The source says more than $6 billion left Binance in one evening on October 29 and reports that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. It also cites CertiK’s adjusted October loss estimate of $3.47 billion and says Binance accounted for 96.7% of that total. The supplied material does not reconcile the two figures or establish a role for AI.
Source: ThorstenMeyerAI.com
