Black October 2026, Episode One: AI’s Place In A Year Of Cybersecurity Challenges

🔍 Read the full analysis: Black October 2026, Episode One: AI’s Place In A Year Of Cybersecurity Challenges on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

October 2026 saw **17,060 new CVE records** published in the U.S. National Vulnerability Database and **$3.47 billion in reported crypto losses**, according to a November 1 analysis by Thorsten Meyer. Yet the Cybersecurity and Infrastructure Security Agency added 36 flaws to its catalog of vulnerabilities known to be exploited, a much smaller year-over-year increase than the rise in disclosures; the report says the figures do not establish that AI caused a general surge in attacks.

Meyer says his count of NVD records published in October excluded rejected entries and was based on an API query on November 1. The total was 3,564 in October 2024 and 4,273 in October 2025 before reaching 17,060 this October. From January through October, he counted 89,859 records in 2026, compared with 39,639 in the same period of 2025. Including rejected records would raise October 2026’s figure to 17,481, he says.

The exploitation figures rose less sharply. CISA’s Known Exploited Vulnerabilities catalog gained 36 entries in October, compared with 31 in October 2025 and 17 in October 2024. Its 282 additions in the first ten months of 2026 exceeded the 245 additions recorded throughout 2025. The catalog is intended to identify vulnerabilities for which CISA has evidence of exploitation, rather than count every flaw disclosed.

For crypto losses, the analysis cites CertiK’s October estimate of $3.47 billion after accounting for frozen and returned funds, versus $68 million in October 2025. It says the reported Binance theft on October 29 made up 96.7% of October’s total. The FBI attributed that theft to North Korea’s “TraderTraitor” on October 31, according to the source. These are attributed figures and findings, not an independently verified accounting in the supplied material.

Disclosure Outpaced Exploitation

The figures measure different stages of cybersecurity risk. A CVE disclosure records that a vulnerability is known; it does not by itself show that attackers used it. CISA’s KEV entries represent flaws for which the agency reports evidence of active exploitation. Treating the disclosure surge as an equivalent rise in attacks would blur that distinction.

That difference matters to security teams deciding which fixes to prioritize. The report says October’s KEV additions rose 16% from a year earlier while CVE publications quadrupled. It also cites Google threat intelligence researchers’ estimate that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That estimate, as presented by Meyer, cautions against using raw CVE totals as a proxy for immediate attacker activity.

AI is part of the story, but not a single explanation for it. Meyer says Microsoft’s October security release credited an AI model or AI vulnerability research firm in at least 65 entries, including one flaw already exploited. The reported Binance theft, by contrast, is described as beginning with a compromised laptop. The evidence presented supports examining both AI-assisted discovery and AI-assisted exploitation, but does not establish AI as the cause of October’s overall totals or largest loss.

Products Worth Considering

Jackery Explorer 2000 v2 Portable Power Station, 2042Wh

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Three Measures, Three Different Signals

Meyer organizes the report around disclosed vulnerabilities, documented exploitation and reported crypto theft. These measures have different sources and limits: NVD records published CVEs, CISA tracks vulnerabilities with evidence of exploitation, and crypto-loss estimates are based on incidents and asset movements. They should not be read as interchangeable counts of “hacks.”

The report also cites a Google threat intelligence analysis published September 30. For January through August 2026, that group counted 141 distinct vulnerabilities disclosed and exploited, compared with 127 across all of 2025. It reported an average of 18 such vulnerabilities per month in 2026, up from 10.5 per month in 2025. Meyer says the group found that exploitation rose roughly in step with disclosures, while the number of disclosed flaws grew much faster in his October comparison.

Counts depend on how records are collected and classified. Meyer notes that automated assignment practices can add many CVEs: the Google group reportedly identified about 5,000 Linux-kernel-related CVEs from January to August, with no observed zero-day exploitation in that group. That example illustrates why a larger disclosure count does not automatically mean more flaws are being exploited.

““Some of it supports my view. Some of it does not.””

— Thorsten Meyer, in the November 1 report

AI’s Share Remains Unmeasured

The supplied report does not establish how much AI contributed to October’s vulnerability totals, how many attackers used AI to exploit flaws, or whether AI changed the number of successful attacks. Its statement that attackers can turn fixes into exploits within days is presented as Meyer’s thesis, not as a quantified result across incidents.

The report says PHP2Shell vulnerabilities patched on October 21 came from OpenAI’s Patch the Planet program, and that an embargo broke before release. It does not provide enough detail here to assess the disclosure timeline, identify the person or group responsible for the breach of the embargo, or measure any resulting exploitation. It also says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months, but the supplied text gives no counts or methodology.

The $3.47 billion estimate depends heavily on the attributed Binance incident, which the source says accounted for 96.7% of the monthly total. The supplied material does not give a full incident breakdown, explain the underlying calculation, or independently substantiate the FBI attribution. The figures may also change as investigations and recovery efforts continue.

Incident Evidence Will Shape the Picture

The next useful evidence will come from incident investigations and updated vulnerability records: whether researchers identify further exploitation, whether CISA adds newly confirmed flaws to KEV, and whether investigators publish more detail about the Binance theft and any recovery of funds. Those developments could change the picture of October’s losses and the number of attacks tied to particular vulnerabilities.

Security teams can use CISA’s exploitation catalog to distinguish flaws with reported active-use evidence from the much larger pool of disclosures, while tracking vendor advisories for patches. The report does not provide a specific next release date for an updated tally or a scheduled follow-up on the AI findings. Meyer’s accompanying video, published with the report, presents the three measures and the AI question in a five-minute overview.

Key Questions

What records did October 2026 set?

According to Meyer’s report, the month had 17,060 newly published NVD CVE records and $3.47 billion in crypto losses after frozen and returned funds were accounted for. The source describes both as October records, but the figures come from different measures and should not be combined into one count of attacks.

Did exploitation rise as fast as vulnerability disclosures?

No. CISA added 36 vulnerabilities to its KEV catalog in October 2026, up from 31 in October 2025. The report’s NVD count rose from 4,273 to 17,060 over the same October comparison. The catalog and disclosure count measure different things.

Did AI cause the record number of vulnerabilities or crypto losses?

The report does not establish that. It describes AI-linked vulnerability research and says attackers can use AI to develop exploits, but it does not quantify AI’s contribution to October’s overall totals. It says the Binance theft began with a compromised laptop, not an AI-found vulnerability.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog lists vulnerabilities for which CISA reports evidence of exploitation. It is a narrower measure than the number of public CVE disclosures and can help readers distinguish known exploitation from the broader pool of reported flaws.

Source: ThorstenMeyerAI.com