News / Industry
Black October 2026: the month cybersecurity set records
Black October 2026 set records for CVEs, exploited flaws, AI-driven attacks and losses. A sourced retrospective, and why continuous exposure management matters.
The security press has a name for the month that just ended: Black October. Across October 2026, four separate measures of cyber risk set records at once, vulnerability volume, actively exploited flaws, the use of AI inside real attacks, and the size of the losses. Black October 2026 is worth reading not as one catastrophe but as four trend lines crossing in the same thirty-one days, each sourced to a different place. Read together, and read carefully, they point to one conclusion about how security has to work now.
Black October 2026 by the numbers
| Metric | 2024 / 2025 | 2026 | Source |
|---|---|---|---|
| CVEs recorded, Jan 1 to Oct 23 | ~38,569 (2025, same window) | ~86,292, about 2.2x | CyberHire analysis, reported by Dev.to |
| CISA KEV additions in October | 17 (2024), 31 (2025) | 36 | CISA KEV catalog, via the Black October analysis |
| CISA KEV additions, year to late October | ~245 (all of 2025) | ~282 | CISA KEV catalog, via the Black October analysis |
Record volume, and what it does not mean
The clearest record is raw vulnerability volume. One analysis of a full CVE list downloaded on October 23 counted roughly 86,292 CVEs published between January 1 and October 23, 2026, about 2.2 times the 38,569 recorded in the same window of 2025 (CyberHire analysis, reported by Dev.to). A single vendor tells the same story. Microsoft's October Patch Tuesday fixed a record 1,411 flaws, more than it shipped across all of 2025, per BleepingComputer, including an actively exploited Windows Shell zero-day, CVE-2026-96951.
What the volume does not prove is cause. The analyst who compiled the CVE count is direct about it: the data cannot separate out AI's share, because most vendors do not disclose how a bug was found. The honest reading is that AI did not create these vulnerabilities so much as make finding them cheap. That is a real shift, but it is a discovery story. It is not proof that the month was more dangerous in proportion to the count.
Record exploitation
Volume is noise until something is used. On that measure too, 2026 set a record. CISA added about 36 flaws to its Known Exploited Vulnerabilities catalog in October, against 31 in October 2025 and 17 in October 2024, and roughly 282 for the year through late October, already more than the 245 added across all of 2025 (CISA KEV catalog, version 2026.10.30, via the Black October analysis). The exploited flaws were not obscure. A GitLab vulnerability rated CVSS 10.0 landed on the KEV catalog, critical PHP flaws tracked as PHP2Shell were exploited in the wild, and actively exploited zero-days hit Cisco and Ivanti VPN appliances, the reachable edge of most corporate networks.
AI on both sides
The year's defining theme matured in October: AI moved from the margins of security into the work itself, on both sides. On offense, CrowdStrike documented four threat actors running AI agents inside real intrusions, from reconnaissance to data theft; researchers tied an agentic penetration-testing framework, ARTEX, to a China-linked group said to have hit more than 200 organizations, a count that is still provisional, per The Hacker News; and an unreleased AI model reportedly chained working exploits across browsers and operating systems. On defense, Google rolled out Gemini 4 Argon and then Gemini 4 Carbon for cyber defenders, per Google. The same capability is being pointed in both directions.
The largest losses
Then the money. Binance reported a theft of roughly $6.3 billion on or around October 29, described by Forbes as the largest cryptocurrency theft on record (Forbes, provisional). By multiple accounts, October 2026 became the costliest month in the history of crypto hacking. The detail that matters for defenders is ordinary. By Binance's own account, the intrusion traced to several breach points, one of them a compromised laptop, not to an exotic new flaw. Forbes is careful on the point most likely to be overstated, that there is no evidence AI caused the breach. The records coincided. They were not shown to be the same story.
A record number of vulnerabilities is not a patching marathon. It is a sorting problem, and sorting by severity alone is how the few reachable risks get lost in the noise.
The Threatless read
Put the four records together and a single problem comes into focus. If vulnerability volume has roughly doubled in a year, the old operating model, rank everything by severity and try to patch all of it, has quietly stopped working. No team's capacity doubled to match. When the list runs to 86,292, the question is no longer how many flaws exist. It is which handful are being exploited, are reachable in your environment, and sit on a path to something that matters. October's own record proves the shape of the answer: a small, identifiable subset, the KEV additions, the VPN zero-days, the one Windows Shell flaw already in use, carried nearly all of the real risk.
That is the case for security that is continuous and prioritized by real, reachable risk rather than by raw count, which is the shape of continuous threat exposure management and of prioritizing by what is actually exploitable. It is the problem we built Threatless CTEM around: not a periodic scan that adds to the pile, but a continuous read on which exposures are reachable and worth acting on first. Black October 2026 did not change that argument. It made it impossible to ignore.