How To Read AI’s Role In Black October 2026’S Cybersecurity Events

🔍 Read the full analysis: How To Read AI’s Role In Black October 2026’S Cybersecurity Events on ThorstenMeyerAI.com

An analysis published November 1 says October 2026 set records for published software vulnerabilities and reported crypto losses, but the available figures do not show that AI caused a matching surge in attacks. The month’s data include 17,060 new CVE records and more than $3.47 billion in crypto losses, while CISA added 36 flaws to its catalog of vulnerabilities known to be exploited—a smaller increase than the jump in disclosures.

Thorsten Meyer says his count of the National Vulnerability Database’s published records, taken through its API on November 1 and excluding rejected entries, found 17,060 CVEs in October. That compares with 4,273 in October 2025. From January through October, the count was 89,859, against 39,639 over the same period in 2025. These are published records, not a count of attacks or proof that every listed flaw is dangerous in practice.

The exploitation tally rose more modestly. CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in 2024. CISA’s catalog version dated October 30 contained 282 additions for 2026 to that point, more than the 245 added during all of 2025. The analysis also cites Google’s threat intelligence group as saying exploitation has risen roughly alongside disclosure over a longer period, with about one in 431 vulnerabilities disclosed in 2026 observed exploited.

On crypto losses, the source attributes a $3.47 billion October total to CertiK after accounting for frozen and returned funds, compared with $68 million in October 2025. It says the reported Binance theft accounted for 96.7% of the month’s total, and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. The source describes the incident as involving a compromised laptop, not an AI-discovered software flaw.

Disclosures Are Not Attacks

The distinction between disclosed vulnerabilities and confirmed exploitation changes what the records can tell readers. The CVE count measures public disclosures; it does not reveal how many flaws attackers used, how many systems were affected, or how much harm resulted. The KEV catalog is a narrower measure because it records flaws for which CISA reports evidence of active exploitation.

That difference matters for security teams deciding where to direct limited patching resources. A rapid rise in disclosures can create a heavier review and remediation workload, but the source’s figures do not support treating every new CVE as an active threat. The reported catalog additions and named affected products—including remote-access gateways, security appliances and other widely used software—offer more actionable signals, though each organization’s exposure will depend on its systems and configurations.

AI’s importance is more specific than a claim that it caused a record month of attacks. The source says AI tools helped identify some flaws and that attackers can use language models to turn public fixes into exploits quickly. Those points raise questions about the time defenders have to patch, but they do not establish that AI drove the CVE totals or the crypto theft. The article’s own account presents evidence both for and against its broader thesis.

Popular right now

Ninja DualZone Smart XL Air Fryer, 10-Qt, 6-in-1, DZ950

AmazonView Latest Price

Dyson V8 Cyclone Cordless Vacuum

AmazonView Latest Price

Ninja NC501 CREAMi XL Deluxe 11-in-1 Ice Cream and Frozen Treat Maker with Two XL Containers

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Three Different October Measures

The analysis separates October into three “ledgers”: disclosed flaws, exploited flaws and stolen crypto. Each measures a different event. CVEs are public records of vulnerabilities; CISA’s KEV list tracks vulnerabilities with evidence of exploitation; crypto-loss estimates aggregate reported thefts and may change when funds are frozen or returned. Comparing their totals can illuminate trends, but they are not interchangeable measures of cybersecurity risk.

The CVE method also affects the reported total. Meyer says the October count rises to 17,481 when rejected records are included, rather than 17,060. He cautions that CVE identifiers themselves are not a reliable proxy for publication totals because numbering authorities may reserve blocks of IDs. The analysis also cites Google’s threat intelligence group, which said automated assignment policies contributed to high counts, including roughly 5,000 Linux-kernel-related CVEs from January through August 2026 with no observed zero-day exploitation in that group’s account.

On AI and vulnerability research, the source says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. It also says PHP flaws known as PHP2Shell were found through OpenAI’s Patch the Planet program and patched on October 21. Google’s Big Sleep, according to the source, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months. These examples show activity in security research; they do not, by themselves, establish that AI caused October’s overall record counts.

What the Figures Cannot Establish

The figures do not establish that AI caused the October CVE surge, increased the number of successful attacks, or played a role in the Binance theft. The analysis reports AI involvement in some vulnerability research and warns that attackers can use AI to adapt fixes, but it does not quantify how often that happened in October or show how many attacks resulted.

The measurements also have limits. CVE totals vary depending on whether rejected records are counted, and the source notes that automated assignment policies can inflate disclosure counts. CISA’s monthly additions are not a complete count of every exploit in use, while crypto-loss totals can change after funds are frozen or returned. The supplied material does not include independent documentation for every figure or detail of the Binance incident, beyond its account of the FBI attribution.

The source says zero-day activity rose only moderately, from an average of eight to 11 a month, but does not provide further detail here about the underlying period or case list. It also points to an embargo breach involving PHP2Shell without specifying what information became public, when it appeared, or the resulting impact. Those gaps prevent a precise assessment of how much faster AI made exploitation in this set of events.

Evidence to Watch in November

The next useful evidence will be whether newly disclosed flaws enter CISA’s KEV catalog and whether security researchers document attacks tied to them. That would help distinguish a continued rise in public vulnerability records from a rise in vulnerabilities attackers are actually using.

Further reporting on the PHP2Shell disclosure timeline could clarify the source’s claim that an embargo broke before the October 21 patch release. Updates to the Binance investigation could also add detail about the reported compromised laptop, the FBI’s attribution and any recovery or tracing of funds. The current material does not provide those case details.

Meyer says he plans to test his thesis against the available measures—published CVEs, known exploited vulnerabilities, zero-days and crypto losses. Until more incident-level evidence is available, the clearest conclusion is limited: October saw an exceptional disclosure count and reported crypto losses, while the exploitation measure rose less sharply and AI’s contribution to the month’s overall cyber activity remains uncertain.

Key Questions

What did the October 2026 analysis report?

It reported 17,060 published CVE records in October, 36 additions to CISA’s Known Exploited Vulnerabilities catalog and $3.47 billion in crypto losses after frozen and returned funds, citing CertiK for the loss estimate.

Does the record CVE count mean attacks also set a record?

No. A CVE is a public vulnerability record, not evidence that attackers exploited the flaw. The analysis says CISA added 36 vulnerabilities to its exploited-flaw catalog in October, a smaller year-over-year increase than the jump in CVE disclosures.

What evidence does the source give for AI’s role?

It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, and cites PHP2Shell and Google’s Big Sleep as examples of AI-related security research. It does not show that AI caused the overall rise in disclosures or the Binance theft.

What does the source say about the Binance theft?

The analysis says CertiK’s October loss total was $3.47 billion after frozen and returned funds, with Binance accounting for 96.7% of the month. It says the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31 and describes the incident as beginning with a compromised laptop. Further incident details are not provided in the supplied material.

Source: ThorstenMeyerAI.com