Product Updates — October 2026: 232 Scanners, PayPal Checkout, and the Open-Source Launch

A lot has shipped at 2MNY over the last few weeks. This post is the running changelog for October 2026 — what changed, why it matters, and where to try each thing.

232 scanner modules, live-verified

The scanner fleet now runs 232 modules across 14 categories — up from 178 earlier this year. Every number we publish is pulled live from the plugin registry on our infrastructure, so the count you see on the features page is the count that actually runs, not a marketing figure.

The newest additions focus on areas we kept finding blind spots in while monitoring our fleet:

• AI/LLM surface detection — eight modules that fingerprint exposed LLM gateways, agent panels, vector databases, model-serving ports and leaked AI-provider API keys. Every week we find more sites accidentally exposing an LLM endpoint to the open internet. If your organization experiments with AI tooling, these modules are the fastest way to find out what your estate is leaking.
• Wider protocol and service coverage — additional LDAP, RDP and legacy-service probes for the deep tiers.
• Error-message fuzzing and account enumeration — new application-logic checks that catch user-harvesting vectors on login and registration flows.

The engine is now open source

The biggest news of the month deserves its own announcement: the core scanning engine — 200 modules, the Docker stack, the report engine — is now open source under Apache-2.0. Read the full story in 2MNY Website Vulnerability Scanner Is Now Open Source, or go straight to the GitHub repository.

PayPal checkout, everywhere

We heard the feedback: bank transfers and crypto are fine for some, but many teams need a card-based flow their finance department already understands. PayPal checkout is now live across all our services:

• Scan plans (Free, Professional, Business, Enterprise) — monthly subscriptions
• 2MNY Shield tiers — annual subscriptions
• The full platform source code — one-time purchases

Every checkout generates an invoice in your dashboard immediately, and payment confirmation is verified server-side against PayPal — your invoice updates the moment payment clears, with no manual waiting.

Yearly Update + Support plan for source-code owners

Teams that buy the full source-code platform now have an optional Yearly Update + Support plan at 49 USD/year. It works like maintenance for the codebase you bought: engine improvements, new scanner modules, security fixes for the platform code itself, and a direct support line for installation and upgrade questions. It is optional — your license does not expire without it — but it is the cheapest way to keep your self-hosted platform current with what we run ourselves. Details on the full-pack page.

Report engine polish

Two changes customers asked for and got:

• Redacted customer reports got cleaner section ordering, so non-technical stakeholders see the "what should I do" summary before the evidence trail.
• Technical reports now group findings by attack surface rather than strict severity, which is how remediation actually gets planned in the real world. Severity sorting is still one click away.

Fleet scale

The monitoring fleet crossed 29,000 domains under continuous observation, including national-scale government and education estates. That volume is what feeds our false-positive guards — when a check misfires on one site out of ten thousand, we see it, and the guard gets written. The sample report shows what the output looks like on a real target.

Coming next

On the roadmap for the next cycle: more community contributions merged into the open-source edition, expanded WordPress plugin-intelligence coverage, and scheduled digest emails that summarize what changed on your watched domains since the last scan. If you have a specific request, the contact page reaches us directly.

Try the free scan on the homepage — no signup needed to start.