Explainer
What is “Black October”?
“Black October” is what the press started calling October 2026 in cybersecurity: a month with a record number of newly found software flaws, many of them found by AI.
The gap behind the headline
- AI finds flawsIt reads code at machine speed.
- Records pile upA record number of new CVEs in one month.
- Few people fixOften volunteers, in their spare time.
- The gapFinding is fast, fixing is slow.
If finding flaws is now cheap and fixing them is not, the software you rely on, from your phone to your bank, is only as safe as the volunteers and teams who patch it. That is where attention and money have to go.
The short version
- Security researchers, helped by AI tools, found software bugs at a pace nobody had seen before.
- By one count, about 14,000 new vulnerability records appeared in the first 25 days of October, more than three times all of last October.
- On CNBC, Chris Krebs, the former head of the US cyber agency CISA, said about 3% of all the critical bugs ever found were found in the last month. That figure is his rough estimate. We could not verify it, and “found” may really mean “published”.
- The problem is not finding bugs. It is fixing them. Anthropic’s own dashboard showed 6,157 flaws reported to open-source maintainers on October 2, and about 516 patched, as far as it knew. Roughly one in twelve.
Why AI is behind it
AI models read code very fast. Good people use them to find flaws before attackers do. But the same skill helps the attacker. With the PHP flaws, defenders found them with AI, and attackers were already trying them four days before the public warning.
Why fixing is the real gap
Finding a bug now runs at AI speed. Fixing it still runs at human speed, often a handful of tired volunteers who maintain an open-source project in their spare time. If finding becomes cheap, the people and the money have to go to fixing.
Read the full editorial
Our weekly opinion piece Le Café Noir, October 29, 2026 goes through four true stories behind “Black October”, the numbers with their sources, and what to do about it. Every Thursday, Le Café Noir looks at where AI is going, and at its risks.
Sources
- CNBC: AI’s “Black October” (Chris Krebs)
- 1023 Jack: analysis of NVD and CVE.org records
- Anthropic: coordinated vulnerability disclosure dashboard
Get The AI Daily Grind by email, every morning, in simple words.