🔍 Read the full analysis: How A $6 Billion Crypto Heist And Record CVEs Frame AI In Black October on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 report counts 17,060 CVE records published in October 2026 and 36 additions to CISA’s Known Exploited Vulnerabilities catalog. It also reports that the FBI attributed the Binance theft to North Korea, while the source’s claims about AI-assisted vulnerability discovery and exploitation remain distinct from evidence that AI caused the record losses.
October 2026 set a monthly record for published vulnerability records, while CISA added 36 flaws to its catalog of vulnerabilities known to be exploited, according to figures in a November 1 report by Thorsten Meyer. The report also says the FBI attributed a theft of more than $6 billion from Binance on October 29 to North Korea; the figures describe separate security measures and do not establish that AI caused the theft or the record disclosures.
Meyer says his count of the National Vulnerability Database (NVD), using its API and excluding rejected records, found 17,060 CVEs published in October, compared with 4,273 in October 2025. From January through October, the count was 89,859, against 39,639 for the same period a year earlier. Including rejected records would put October’s total at 17,481, the report says. CVEs are public records of reported vulnerabilities; their number does not by itself measure how many flaws attackers exploited.
The exploitation figures grew less sharply. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The report counts 282 additions in 2026 through October, already more than the 245 added in all of 2025. Five October additions concerned older flaws dating from 2015 to 2023, for which the report says new exploitation evidence had emerged.
For the crypto loss figure, Meyer cites blockchain security firm CertiK, which counted $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. The report says the Binance theft accounted for 96.7% of October’s total. It attributes the FBI’s identification of the suspected actor to an agency statement dated October 31, but the source does not provide details of the FBI’s evidence.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Why the Three Security Measures Differ
The figures point to a larger pool of publicly recorded vulnerabilities, but they do not show a matching increase in flaws confirmed as actively exploited. CISA’s 36 October additions were up from 31 a year earlier, while NVD’s October publication count was about four times its 2025 level. That gap matters to security teams: disclosure volume is not a direct measure of immediate attack risk, and prioritization needs evidence about exploitation and the systems affected.
The report cites Google Threat Intelligence Group (GTIG) as saying that roughly one in 431 vulnerabilities disclosed in 2026 had been observed exploited. GTIG also found that automated assignment policies can inflate CVE totals: its analysis said descriptions mentioning the Linux kernel accounted for about 5,000 CVEs from January through August, with no observed zero-day exploitation among those records. These numbers are attributed assessments, not proof that unexploited vulnerabilities are harmless.
The theft figure adds a separate warning about the scale of crypto losses. Yet the source says the Binance incident began with a compromised laptop, not an AI-discovered vulnerability. That distinction limits what the episode can show about AI and cybercrime: it is evidence of a major reported theft, not evidence that AI enabled it.
Popular right now
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Dried Rose (KSM150PS)
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
October’s Disclosure and Exploitation Counts
The report separates cybersecurity activity into three ledgers: disclosed flaws, vulnerabilities with evidence of exploitation, and money stolen in crypto incidents. The measures capture different events. An NVD publication records a vulnerability; CISA’s KEV catalog records flaws for which it has reliable evidence of active exploitation; blockchain loss estimates track reported financial impact. Combining them into one “record hacks” figure would obscure those differences.
Meyer’s NVD series shows October counts rising from 3,564 in 2024 to 4,273 in 2025 and 17,060 in 2026. His January-to-October comparison puts 2026 at 89,859, versus 48,151 for all of 2025. These are counts produced under the report’s stated method and queried on November 1; the source cautions that including rejected records changes the October result.
The source also points to examples it says connect AI research with vulnerability discovery and repair. It reports that at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It says OpenAI’s Patch the Planet program produced the PHP2Shell flaws, patched October 21, and that Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. Those statements describe specific reported cases; they do not establish that AI caused the month’s overall CVE increase.
“October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, the report’s author
What the October Figures Cannot Prove
The data do not establish why NVD publications surged, or how much of the increase reflects newly discovered flaws, reporting practices or automated CVE assignment. The source cites GTIG’s concerns about automated records, but does not provide a full breakdown of October’s 17,060 entries by cause or numbering authority.
Nor do the figures show that AI drove a comparable jump in successful attacks. The report says GTIG found exploitation had risen roughly in step with disclosure and that observed zero-days averaged 11 a month, up from eight. Those figures are presented as GTIG’s analysis, and the source does not specify enough methodology here to independently assess the estimate. The claim that AI can help attackers turn fixes into exploits within days is the author’s thesis; the material does not quantify how often that happened in October.
The Binance total, the precise path by which the attackers gained access, and the FBI’s basis for attributing the incident remain incompletely detailed in the supplied source. It also does not establish whether the reported crypto loss estimate will change as funds are traced or recovered. The report’s AI-related examples concern vulnerability research and patching, not a demonstrated AI role in the Binance theft.
Evidence to Watch After October
Readers should watch for updated NVD and CISA records, which may change the month’s counts as entries are revised or added. CISA’s KEV additions will provide a continuing, narrower indicator of vulnerabilities for which exploitation evidence has been identified; they should not be treated as a complete count of attacks.
Further reporting or statements from the FBI, Binance and blockchain investigators could clarify the theft’s losses, the alleged intrusion route and the attribution. Separately, more technical detail from Microsoft, OpenAI and Google could help establish what AI tools contributed to the cited vulnerability research, and whether those systems found flaws that conventional methods would have missed. Until then, the report supports a record disclosure month and a major reported theft, but leaves the scale of AI’s effect on exploitation unresolved.
Key Questions
How many CVEs were published in October 2026?
Meyer’s NVD API count found 17,060 records, excluding rejected entries. Including rejected records, the report says the count would be 17,481.
Did exploited vulnerabilities rise as much as disclosures?
No, not in the figures cited. CISA added 36 vulnerabilities to its KEV catalog in October, compared with 31 in October 2025, while the NVD publication count rose from 4,273 to 17,060. The measures track different things.
Who did the FBI blame for the Binance theft?
Meyer’s report says the FBI attributed the October 29 theft to North Korea’s “TraderTraitor.” The supplied source does not include the FBI’s supporting evidence or a detailed account of the attribution.
Does the report show AI caused the Binance theft?
No. The report says the theft began with a compromised laptop and presents AI-related vulnerability research as a separate development. It does not establish that AI played a role in the Binance incident.
Source: ThorstenMeyerAI.com
