Black October: The haystack doubled… but what about the needles?

If you've been anywhere near security social media this month, you've heard the language. "Black October." A "vulnerability tsunami." Microsoft commented that AI is changing the physics of cybersecurity. We even saw a "vulnpocalypse" thrown out there.

CVE volume has more than doubled this year, and AI systems are demonstrably finding serious bugs in some of the most reviewed code on the planet. But the question that matters for defenders is narrower: has confirmed exploitation scaled at the same rate?

It hasn't. Disclosures are up roughly 2.3x on the same window last year. CISA's Known Exploited Vulnerabilities (KEV) catalog is up about 31%. The share of new CVEs that reach confirmed exploitation has fallen.

That's the thesis of this post: absolute exploitation is up, but it is a smaller slice of a much bigger pile. The operational problem is prioritization and detection under higher noise, not every new disclosure turning into an attack.

The disclosure surge is real

The National Vulnerability Database (NVD) recorded about 88,700 CVEs published between January 1 and October 29, 2026, against about 39,300 in the same window of 2025. That is roughly 2.3x, and already 84% above all of 2025 (48,151). 

Two other independent counts agree. CyberHire's analysis of the CVE List found 86,292 through October 23, and Brandefense's NVD pull found 86,533 through October 25. Q3 alone produced 36,953 CVEs, more than any full year before 2024. September averaged one new CVE every 2.9 minutes.

Before reading too much into the total, three caveats:

• Some of it is counting. Google estimates about 5,000 Linux kernel CVEs from automated assignment through August, and the number of CVE Numbering Authorities grew from 484 to 559 over the past ten months. 
• It is not only counting. CyberHire's tests found that stripping out the Linux kernel, the big WordPress issuers and VulDB still leaves volume tripling (20,242 to 61,970).
• Severity data is patchy. NVD enrichment has fallen behind, so many 2026 CVEs have no NVD severity score yet.

AI is likely the driver

The evidence proves AI is finding real bugs, however, generating accurate statistics for proper attribution of AI-discovered vulnerabilities isn't possible.

What the credit fields show: CyberHire counted 769 CVEs this year whose finder credit names an AI system, up from 34 in the same window of 2025 (22x). Anthropic/Claude appears in 335 CVEs, AISLE in 296, and OpenAI in 112. But that accounts for less than 1% of all 2026 CVEs, and it is a floor: most practitioners or CNAs don't credit their tools.

What the primary sources show.

• Anthropic reports an unreleased research model found bugs behind 62 Chrome CVEs, all rated critical or high, plus exploit chains on other platforms. 
• Apple's macOS Golden Gate 27.2 security notes list 263 CVEs, with credits to Anthropic Research and OpenAI Codex Security on several entries. 
• PHP2Shell was found independently by Wiz (using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol) and by Calif with OpenAI. Wiz says the flaws sat in PHP for over a decade and that AI made the exploit practical. 
• XBOW says one researcher directing AI agents on GPT-5.6 Sol chained three unknown Chrome bugs into a Windows code-execution chain in six days, earning Google's $250,000 full-chain bounty. The roughly $40,000 compute cost is XBOW's own estimate, and XBOW says the bugs were never used against real users. 

Put together: discovery is clearly accelerating, and AI is plausibly a major part of why. How much of the 2x is AI, versus automated CVE assignment, more CNAs and general effort, nobody can say yet.

Confirmed exploitation rose, but more slowly

CISA's KEV catalog is the clearest public signal of confirmed in-the-wild exploitation. Through October 28, CISA had added 278 vulnerabilities in 2026, versus 212 in the same window of 2025. That is about 31% more, and already above the 245 added in all of 2025. 

Disclosures roughly doubled; KEV additions rose by about a third. Two ways to see the gap:

• Additions per 1,000 new CVEs: about 6.5 in 2023 (187 additions, 28,816 CVEs) versus about 3.1 in 2026 (278 additions, about 88,700 CVEs). This is a rough ratio, since KEV additions include older CVEs, but the direction is clear. 
• Share of 2026 CVEs seen exploited: Google's threat intelligence group puts it at about 0.23%, and a match of KEV against 77,944 scored 2026 CVEs gives 183, or 0.235%, as of October 22. 

At face value this would seem like a good thing, but two important caveats cut against reading this as good news:

• KEV lags. The median time from CVE publication to KEV listing is 33 days over the past 12 months. Recent CVEs may be exploited but not yet counted, so the share could creep up as listings catch up. 
• Old bugs still matter. Of the 270 KEV additions through October 20, 49 were CVEs from 2024 or earlier that were only confirmed exploited this year. The haystack grew, but so did the evidence that attackers keep reusing what already exists.

What the mismatch means for your team

Volume is a poor proxy for risk. Microsoft's October Patch Tuesday was a record, at roughly 1,400 CVEs depending on who is counting. Exactly one was confirmed exploited: a Windows Shell Mark of the Web bypass, CVE-2026-96951. A record count of fixes is not a record count of threats. 

The exploited minority is concentrated at the edge. Of the 38 KEV additions between September 21 and October 20, 15 were firewalls, VPNs, gateways, or remote-access tools. Recent cases show the pattern:

• Citrix NetScaler and BeyondTrust Remote Support were exploited for weeks before the flaws were disclosed.
• Check Point's gateway flaw was attacked three days after its fix shipped.
• Ivanti Connect Secure fell to a previously unknown actor Volexity tracks as UTA0576, who chained three zero-days to get root on a fully patched appliance from October 3. Volexity observed it on one customer's device. 

Prioritization signals have gaps. On October 22nd, 46% of the vulnerabilities CISA had confirmed as exploited in 2026 still scored below 0.1 on EPSS, including several of the edge zero-days. The NVD also has a massive backlog. In August, Simbian AI reported 78.7% of incoming CVEs sitting in an "Awaiting Analysis" queue before the policy cutoff.

When a bug does get weaponized, it moves fast. PHP2Shell is the case study. Exploitation attempts were reported from October 17, four days before the October 21 patch (a leak pulled the release forward a day), and CISA added both CVEs to KEV on October 26. Recent Microsoft reports note the median time from discovery in the wild to weaponization is well below 24 hours. Citrix NetScaler and BeyondTrust Remote Support exploits described above also corroborate this fact.

Detection has to be deliberate, focused, and behavioral. With this many disclosures, you cannot write signatures for everything. Your team would end up falling behind the latest, potentially riskier threats, and could experience some serious analysis fatigue or burnout. Both variables overall would contribute to your team becoming less effective, more likely to miss, or be slow to respond to the actual pertinent risk to the organization. It's more important to focus on the fundamentals and have defense in depth than chase every vulnerability.

The takeaway

Discovery has more than doubled, confirmed exploitation is up about a third, and the share of new CVEs that get exploited is lower. "Tsunami" captures a real change in discovery velocity but doesn't describe uniform, immediate exploitation of the new volume. Even if the vast majority of CVE's won't see exploitation in the wild, there is still a dangerous subset that poses great risk and moves fast.

The durable response isn't to chase every CVE. It is to know what is exposed in your environment, prioritize and aggressively implement patches or mitigations on edge devices within hours rather than days, investigate for compromise alongside patching, and ensure you have visibility and response capabilities along these vectors. Consideration of risk, effective prioritization and fast remediation of threats has to be your modus operandi and can make the difference in preventing an incident. Don't depend exclusively on external sources for your risk determination or prioritization since threats are moving faster than the intelligence community can fully assess them.

When it comes to ongoing monitoring, ensure you have thorough visibility and detections along all post-exploitation vectors then heavily stack detections targeting TTPs that occur earlier (left) in the attack lifecycle. Remember that behavioral detections are more resilient over time. Your key security domains are Authentication, Network, Email and Endpoint (and cloud). Any threat that achieves material impact to your organization will have to touch one of these.

Three numbers worth tracking: monthly KEV additions, the share of new CVEs reaching KEV, and time-to-exploit for edge devices. If the first two start converging with disclosure volume, the vulntsunami or vulnpocalypse framing earns its keep.