Kali Linux 2026.3 arrived on October 26 as the third point release of 2026, bringing a broad set of updates across tools, the kernel, desktops, and the mobile-focused NetHunter platform. This release packages 126 updated packages, bumps the rolling-kernel from 6.19 to 7.1.5, and refreshes the image-building scripts while introducing six new penetration-testing utilities. For users and builders, the release mixes practical tool additions with infrastructure and documentation changes meant to make Kali easier to build, customize, and run on a wider range of hardware.
Six New Penetration Testing Tools
Kali 2026.3 adds six tools to its repositories, expanding coverage for web discovery, XSS testing, URL processing, fast port scanning, radio research, and SMB data scanning.
Dalfox is an open-source automated XSS scanner designed to test parameters and verify cross-site scripting flaws. Katana is a crawling and spidering framework that helps researchers map web applications, parse JavaScript, and discover files and endpoints before deeper testing. Qsreplace reads URLs from standard input and replaces query-string values with a chosen value to prepare repeatable URL test sets. Rustscan is a high-speed port scanner written in Rust that can quickly find open ports and hand results to Nmap for deeper analysis. SDRangel is a Qt-based software-defined radio front end that supports devices such as RTL-SDR, BladeRF, and HackRF, providing a graphical interface for receiving, sending, and studying radio signals. Snaffler-ng searches readable Windows SMB shares for exposed credentials and sensitive files, supporting NTLM and Kerberos, DFS discovery, archive checks, classification rules, SQLite resume, and multiple output formats.
| Tool | Main purpose | Key use |
|---|---|---|
| Dalfox | Automated XSS scanner | Finds and verifies cross-site scripting flaws by testing web parameters. |
| Katana | Web crawling and spidering | Maps websites, parses JavaScript, finds endpoints, and supports standard or headless crawling. |
| Qsreplace | Query-string replacement | Reads URLs from standard input and replaces their query values for repeatable web security tests. |
| Rustscan | Fast network port scanner | Finds open ports quickly and can pass the results to Nmap for deeper checks. |
| SDRangel | Software-defined radio interface | Provides a graphical front end for radio devices such as RTL-SDR, BladeRF, and HackRF. |
| Snaffler-ng | SMB data scanner | Searches readable Windows SMB shares for exposed credentials and sensitive files. |
These tools extend Kali’s default toolset in ways that help both web and wireless researchers as well as red-teamers working with network and file-share discovery. As always, these utilities should be used only on systems where the operator has explicit permission to test.
Linux Kernel 7.1.5 and Package Updates
The rolling release moves Kali’s main kernel to 7.1.5-1kali1, reflecting the upgrade from the previous 6.19 base and part of a larger set of 126 package updates included in this release. The kernel upgrade improves hardware support, drivers, and includes relevant security and stability fixes—changes that matter for wireless adapters, GPUs, virtualization, and any custom kernel modules. Kali advises testing important hardware and workflows after upgrading, especially before relying on the updated system in live security engagements.
A notable infrastructure change in this release is the refresh of Kali’s public build scripts used to create official images. The updated scripts adopt a more consistent structure, command-line options, and output across platforms. Each refreshed project now provides a build-in-container.sh script that detects Docker or Podman, creates a container, and runs the image build inside it—removing the previous constraint that builds be run on a Kali host and simplifying repeatable builds on other Debian-based systems. Kali improved related documentation and provided guidance for building standard installers (clone kali-installer, install dependencies, run sudo ./build.sh) and for containerized builds via sudo ./build-in-container.sh. The team noted some scripts missed the 2026.3 deadline and will continue the refresh in 2026.4, warning teams with CI pipelines based on older scripts to review their workflows.
KDE Plasma 6.7 and New Icons
Kali’s optional KDE desktop was updated to Plasma 6.7, bringing feature improvements like per-screen virtual desktops that let users change the workspace on one monitor independently of others—a practical improvement for multi-monitor setups where tools like Burp Suite, terminals, and notes are split across displays. Plasma 6.7 also adds more Wayland protocol and portal support, better performance and power efficiency for integrated Intel graphics, improved CPU-rendered application handling, and enhancements for systems with many full-screen windows.
Other desktop polish includes a light/dark theme switch, improvements to Breeze, the return of Oxygen and Air styles, and an early preview of the Union theming system. Kali also added icons to tools that lacked them and updated older icons so applications are easier to find in menus and on the Kali tools website. Xfce remains the default desktop despite KDE receiving this main desktop update.
Major Kali NetHunter Changes
NetHunter, Kali’s Android and wearable security testing platform, sees some of the release’s most distinctive changes. The team resolved compatibility issues between modern systemd/udev components and older mobile kernels without requiring large kernel patches. Wardriving is now supported on the TicWatch Pro 3 series via an updated libnexmonkali library that enables internal Wi-Fi monitor mode on the watch, allowing tools inside the Kali chroot—such as Aircrack-ng and Kismet—to use the watch’s wireless hardware (installation remains involved and requires bootloader, recovery, OS, root, and NetHunter changes).
WearHunter is introduced as an experimental feature that lets a phone control a NetHunter watch over ADB via Wi‑Fi or Bluetooth to run commands and install apps. NFC Arsenal now provides NFC access to the Kali chroot, enabling read, clone, and edit operations for Mifare Classic cards without an external adapter. The release also adds KernelSU support to allow generated installer ZIPs to be installed through the KernelSU app on patched kernels.
Other NetHunter improvements include a fix for TicWatch Pro 3 reboot problems, early support for devices that do not use ramdisks, the return of Bluetooth Arsenal’s airplane mode, easier EvilTwin and Wardriving starts, Nexmon monitor-mode support for custom commands and Wifite, and fixes for an application storage-request crash along with various bug and performance improvements.
Nine new device kernels were added to NetHunter, covering a range of phones and OS builds:
- Google Pixel on LineageOS 22.2 with Android 15
- Huawei P9 on EMUI 8 or LineageOS 16
- LG K20 Plus on LineageOS 14.1
- Moto G Stylus 5G 2022 on LineageOS 23.2
- Nubia Z17 on LineageOS 22.2
- POCO X5 5G and Redmi Note 12 5G on crDroid 12
- Redmi Note 5 Pro on LineageOS 18.1
- Sony Xperia 10 V on LineageOS 23.2
- Ulefone Armor 34+ on Android 16
Kali also highlighted the Wardriver Project—a 2021 Honda Civic Type R demo used to show how vehicle culture, wireless research, and cybersecurity can intersect.
Website and Documentation Updates
Kali updated the tools website (kali.org/tools) to apply the desktop category layout and new icons. Users who prefer the classic compact view can still access the Top 100 tools page. The documentation set grew with three new pages covering vendor firmware extraction and squash for mainline Linux, importing pre-made Kali QEMU VMs, and using NetHunter EvilTwin. Nine existing guides were also updated, with topics including Live USB persistence, graphics on bare-metal systems, NetHunter on the TicWatch Pro 3, Kali as a UTM guest, Xfce FAQ updates, Raspberry Pi full-disk encryption, setting up a Kali mirror, and SSH configuration. Four new European mirrors were added in the Netherlands, Portugal, and Switzerland, while Kali reiterated a warning against mixing external repositories into the Kali source configuration.
Downloading and Upgrading Kali 2026.3
New users can download tested installer, live, VM, ARM, cloud, container, and NetHunter images from the official Kali download page; Kali recommends the latest point-release images for most users because weekly images are automated and don’t receive the same quality checks. Rolling users should confirm /etc/apt/sources.list.d/kali.sources points to the official kali-rolling repository (main, contrib, non-free, non-free-firmware) before running sudo apt update and sudo apt full-upgrade -y. If a reboot is required, restart before verifying results.
After upgrading, check the installed release with grep VERSION /etc/os-release to confirm 2026.3 and confirm the active kernel with uname -r (the AMD64 example shows 7.1.5+kali-amd64). Kali recommends testing tools before important engagements and avoiding upgrades during active work because rolling updates can occasionally disrupt tool functionality. The release announcement also urged integrating timely defenses against new malware and leveraging threat intelligence as needed.
Licensed under CC BY-ND 4.0 International