Black October 2026, Episode One: AI Amid Record CVEs And A $6 Billion Heist

🔍 Read the full analysis: Black October 2026, Episode One: AI Amid Record CVEs And A $6 Billion Heist on ThorstenMeyerAI.com

For listenersOffer from Amazon

Turn your quiet moments into listening time

• Thousands of audiobooks, podcasts and originals
• Listen on your phone, tablet or Echo — also offline
• Cancel anytime

Try Audible free →Free trial for new members

As an affiliate, we earn on qualifying purchases.Hide

A November 1 report says **October 2026 set a record for published vulnerability disclosures**, with 17,060 new CVE records in the U.S. National Vulnerability Database, while **more than $6 billion left Binance in one evening** on October 29. The report separates those events from evidence of active software exploitation: CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog during the month, and the FBI attributed the Binance theft to North Korea’s TraderTraitor operation on October 31.

The figures come from a post by Thorsten Meyer, who says he queried the **NVD API on November 1**, counted records by publication date and excluded rejected records. On that basis, October had **17,060 published CVEs**, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October, the post counts 89,859 records in 2026, against 39,639 in the same period of 2025. Meyer says including rejected records would raise October 2026’s count to 17,481.

The report’s exploitation figures rise, but less sharply. CISA added **36 vulnerabilities to its KEV catalog** in October, compared with 31 in October 2025 and 17 in October 2024. The catalog had 282 additions in 2026 through October, exceeding the 245 additions reported for all of 2025. The post notes that five October additions were older vulnerabilities, disclosed from 2015 to 2023, for which new evidence of exploitation had emerged.

On the theft, the report cites CertiK’s estimate of **$3.47 billion in October crypto losses** after frozen and returned funds were accounted for, compared with $68 million in October 2025. It says Binance made up 96.7% of the October total. The FBI attributed the Binance incident to North Korea’s TraderTraitor on October 31, according to the post; the supplied material does not provide an FBI statement or a detailed account of the incident’s mechanics.

Disclosure Outpaced Confirmed Exploitation

The distinction between vulnerability disclosure and demonstrated exploitation changes how readers should interpret a record CVE count. CVEs record that flaws have been published; they do not show that attackers used every flaw. The report’s comparison—**17,060 new CVEs versus 36 KEV additions in October**—shows why a disclosure surge cannot, on its own, be treated as a matching surge in successful attacks.

That does not mean the rise in exploitation is unimportant. CISA’s catalog reached **282 additions by the end of October**, already above its full-year 2025 total, and includes widely used network and software products, according to the report. Security teams may need to prioritize verified exploitation evidence alongside the much larger flow of newly disclosed records.

The Binance figure points to a separate risk: crypto losses can be large even when the initial route is not a newly discovered software flaw. Meyer says the theft began with a compromised laptop, rather than an AI-found bug. That account is the author’s characterization in the source, not a technical finding documented in the supplied material.

Products Worth Considering

Withings BPM Connect Wi-Fi and Bluetooth Blood Pressure Monitor

AmazonView Latest Price

Oura Ring 4 Smart Ring – Silver – Size 8

AmazonView Latest Price

Oura Ring 5 Smart Ring, Silver, Size 7

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Three Different Security Measures

Meyer frames the report around three ledgers: **disclosed flaws, actively exploited flaws and stolen cryptocurrency**. They measure different events and should not be combined into a single count of “hacks.” The NVD publishes CVE records, while CISA’s KEV catalog lists vulnerabilities for which it has evidence of exploitation. Crypto-loss estimates track a different category of incident.

The post also cautions that CVE totals depend on counting methods and who assigns the records. It cites Google Threat Intelligence Group’s observation that automated assignment practices can inflate totals, including about 5,000 Linux-kernel-related CVEs from January to August 2026 with **zero observed zero-day exploitation**, as described in the source. The report says GTIG found 141 distinct vulnerabilities disclosed and exploited from January to August 2026, compared with 127 during all of 2025.

AI’s role in vulnerability research is part of Meyer’s argument, but the source offers specific examples rather than proof that AI caused the wider October totals. It says Microsoft’s October security release credited an AI model or AI vulnerability research firm in at least 65 entries, including a flaw already exploited in the wild. It also says PHP flaws dubbed PHP2Shell came from OpenAI’s Patch the Planet program and were patched on October 21. Google’s Big Sleep, the post reports, found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over six months.

““That is my view, not a measurement.””

— Thorsten Meyer, author of the November 1 report

AI’s Wider Effect Is Unproven

The supplied material does not establish that AI caused October’s record CVE count or the Binance theft. It documents examples of AI-assisted security research and says attackers can use AI to turn fixes into exploits within days, but it does not provide a complete case list or evidence quantifying AI’s contribution to attacks during October. Meyer’s expectation of more major hacks and exploited flaws is explicitly presented as **his view, not a measured result**.

The source also does not include the underlying NVD, CISA, CertiK or FBI records, so its figures and attributions cannot be independently checked from the material provided here. The Binance incident’s precise amount, entry method, recovery status and technical sequence are not fully described. The report’s crypto-loss total is stated after frozen and returned funds are accounted for, but it does not explain that accounting in detail.

Nor does a low ratio of KEV additions to CVE publications prove that the remaining vulnerabilities are harmless. The two catalogs have different inclusion rules and timelines, and CISA additions reflect evidence available to the agency. The source says Google’s threat intelligence group found exploitation rising roughly in step with disclosure over its chosen period, underscoring that the October comparison is not the only measure of risk.

Track Exploitation and Incident Findings

The next useful developments are updates to CISA’s KEV catalog, fuller technical reporting on the Binance theft, and additional evidence about whether AI tools are helping attackers exploit vulnerabilities more quickly. The source does not identify a scheduled investigation report or a forthcoming milestone for the Binance case.

For readers following the figures, later comparisons should use consistent periods and counting rules: CVEs by publication date, KEV additions by catalog update, and crypto losses with the treatment of frozen or returned funds made clear. Those distinctions will help show whether October was an outlier, a sustained change in disclosure, or evidence of a lasting change in exploitation.

Key Questions

What happened in October 2026?

Thorsten Meyer’s November 1 report counts **17,060 new CVE records** published in October and says more than $6 billion left Binance in one evening on October 29. It also reports 36 October additions to CISA’s exploited-vulnerability catalog.

Does the CVE record mean attacks also hit a record?

Not by itself. A CVE is a public record of a vulnerability, while CISA’s KEV catalog lists flaws with evidence of active exploitation. The source reports a much sharper rise in published CVEs than in October KEV additions.

Who did the FBI blame for the Binance theft?

According to the supplied report, the FBI attributed the theft to North Korea’s **TraderTraitor** operation on October 31. The material does not include the FBI’s original statement or full technical details.

Did AI cause the October security records?

The source documents AI-related vulnerability research and says attackers can use AI to develop exploits, but it does not establish that AI caused the record CVE count or the Binance theft. The author labels the broader prediction as a view rather than a measurement.

Source: ThorstenMeyerAI.com