Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5.
The update follows June’s Kali Linux 2026.2 release, which added nine tools, changed Kali’s APT source format, and improved virtual machine boot times. It also continues the tool and mobile testing work seen in Kali Linux 2026.1, the first major Kali update of the year.
The six new tools are available from Kali’s network repositories. Dalfox is an open-source cross-site scripting scanner built for automation and parameter checks.
Katana is a crawling and spidering framework that can help researchers map web applications and find paths, files, and endpoints before deeper testing.
Qsreplace takes URLs from standard input and replaces query string values with a chosen value, which makes it useful for preparing URL lists for repeatable web tests.
Rustscan is a fast port scanner written in Rust. It can scan large port ranges and pass discovered ports to Nmap for deeper service checks. SDRangel is a Qt-based software-defined radio front end that supports devices such as RTL-SDR, BladeRF, and HackRF, giving wireless researchers a visual tool for receiving, sending, and studying radio signals.
| Tool | Main purpose | Key use |
|---|---|---|
| Dalfox | Automated XSS scanner | Finds and verifies cross-site scripting flaws by testing web parameters. |
| Katana | Web crawling and spidering | Maps websites, parses JavaScript, finds endpoints, and supports standard or headless crawling. |
| Qsreplace | Query-string replacement | Reads URLs from standard input and replaces their query values for repeatable web security tests. |
| Rustscan | Fast network port scanner | Finds open ports quickly and can pass the results to Nmap for deeper checks. |
| SDRangel | Software-defined radio interface | Provides a graphical front end for radio devices such as RTL-SDR, BladeRF, and HackRF. |
| Snaffler-ng | SMB data scanner | Searches readable Windows SMB shares for exposed credentials and sensitive files. |
Snaffler-ng searches readable Windows SMB shares for credentials and sensitive data. It supports NTLM and Kerberos sign-in, DFS discovery, archive checks, built-in classification rules, SQLite resume support, and several output formats.
These additions cover web discovery, XSS testing, URL processing, port scanning, radio research, and file-share review. Like any security tool, they should only be used on systems that the tester owns or has clear permission to assess.
Linux Kernel 7.1.5 and Package Updates
Kali 2026.3 contains 126 package updates and moves the main Kali kernel from 6.19 to 7.1.5. Kali’s package tracker lists 7.1.5-1kali1 for the rolling branch, confirming the kernel used by the new release.
The newer kernel matters because it provides the base for hardware support, drivers, system calls, and security fixes used by the rest of the distribution. Users should still test wireless adapters, graphics drivers, virtualization tools, and any custom kernel modules before relying on the update during live security work.
One of the largest changes is the refresh of Kali’s public build scripts. These are the same scripts the project uses to create the official images offered through its download site. The refreshed scripts now have a more consistent structure, layout, command-line options, features, and output across supported platforms.
Each refreshed project includes a build-in-container.sh script. It detects whether Docker or Podman is present, creates a build container, and runs the image build inside that container. This removes the earlier need to build Kali on a Kali system and makes the process easier to repeat on other Debian-based hosts. Kali has also improved its related build documentation.
Users who want to build a standard installer can clone the kali-installer build repository, install the required packages, and run sudo ./build.sh. The default command creates a Kali rolling installer for AMD64. Builders can change the hostname, add packages such as Rustscan, select kali-dev, choose a netinst image, or target ARM64 through command-line options. Podman users can instead install Podman and run sudo ./build-in-container.sh.
The work is not finished. Kali says some build scripts did not make the 2026.3 deadline, and the remaining refresh is planned for Kali 2026.4. Later stages are expected to focus on automated builds, workflows, example setups, and deeper customization. Teams with CI jobs based on the older scripts should review their pipelines because changes made during the refresh may have broken older workflows.
KDE Plasma 6.7 and New Icons
The optional KDE desktop has been updated to Plasma 6.7. A key feature is per-screen virtual desktops, which lets users change the workspace on one monitor without changing every display.
This can be useful when keeping Burp Suite on one screen, terminals on another, and notes or documentation on a third. Plasma’s Overview also supports faster desktop switching by scrolling or using Page Up and Page Down.
KDE Plasma 6.7 adds more Wayland protocol and portal support, better performance and lower power use for integrated Intel graphics, CPU-rendered applications, and setups with many full-screen windows. Network connections can be duplicated, while System Monitor, software management, printing, background application display, microphone testing, and desktop search controls also receive changes.
KDE has added a light and dark theme switch, improved Breeze, restored the Oxygen and Air styles, and introduced an early preview of its Union theming system.
Kali has also added icons to tools that did not have them and updated older icons so applications are easier to identify in the menu and on the Kali tools website. Xfce remains Kali’s default desktop even though KDE received the main desktop version change in this release.
Major Kali NetHunter Changes
Kali NetHunter, the project’s Android and wearable security testing platform, receives some of the release’s most unusual changes. The team addressed compatibility problems between modern systemd and udev components and older mobile kernels without requiring large sets of patches.
Wardriving is now supported on the TicWatch Pro 3 series. An updated libnexmonkali library enables internal Wi-Fi monitor mode on the watch, allowing compatible tools inside the Kali chroot, including Aircrack-ng and Kismet, to work with the watch’s wireless hardware. Kali’s TicWatch guide says all Pro 3 GPS, LTE, Ultra GPS, and Ultra LTE variants are supported, though installation requires bootloader, recovery, operating system, root, and NetHunter changes.
WearHunter is a new experimental feature that lets a user control a NetHunter watch from a phone through ADB over Wi-Fi or Bluetooth. It can run commands and install applications, with more functions planned. NFC Arsenal now provides NFC access to the Kali chroot and can read, clone, and edit Mifare Classic cards without an external adapter. The release also adds KernelSU support, allowing a generated installer ZIP to be installed through the KernelSU application when used with a patched kernel.
Other NetHunter work includes a fix for TicWatch Pro 3 reboot problems and early support for devices that do not use a ramdisk. Bluetooth Arsenal’s airplane mode has returned. EvilTwin and Wardriving are easier to start, while custom commands now support Nexmon monitor mode and Wifite. Kali also fixed a crash caused by the NetHunter application’s storage request and delivered other bug fixes and speed improvements.
Nine new device kernels were added. They cover Google Pixel on LineageOS 22.2 with Android 15, Huawei P9 on EMUI 8 or LineageOS 16, LG K20 Plus on LineageOS 14.1, Moto G Stylus 5G 2022 on LineageOS 23.2, Nubia Z17 on LineageOS 22.2, POCO X5 5G and Redmi Note 12 5G on crDroid 12, Redmi Note 5 Pro on LineageOS 18.1, Sony Xperia 10 V on LineageOS 23.2, and Ulefone Armor 34+ on Android 16.
The release announcement also highlighted the Wardriver Project, a 2021 Honda Civic Type R shown at the Cars and Cops event in Altus, Oklahoma. The project was used to show how vehicle culture, wireless research, and cybersecurity can meet in a single build.
Website and Documentation Updates
Kali has applied the category layout and icons introduced in its desktop menu to kali.org/tools. Users who prefer the older short view can still open the Top 100 tools page.
The documentation set gains three new pages. They explain how to extract and squash vendor firmware for mainline Linux, import a pre-made Kali QEMU virtual machine, and use NetHunter EvilTwin.
Nine existing guides were updated, covering Live USB persistence, graphics problems on bare-metal systems, NetHunter on the TicWatch Pro 3, Kali as a UTM guest, the Xfce FAQ, Kali NetHunter, Raspberry Pi full-disk encryption, setting up a Kali mirror, and SSH configuration.
The release cycle also added four European mirrors. Two are in the Netherlands at mirror.hacker.nl and mirror.netone.nl. Portugal gained mirror.randhost.com, while Switzerland gained kalimirror.velden.media. Kali’s mirror system can direct users to a nearby current server, but its documentation warns against adding extra repositories to the Kali source configuration because mixing repositories can break an installation.
Kali also thanked community members who worked on documentation, tool pages, NetHunter, and package maintenance. The long contributor list reflects how much of the mobile kernel, device, documentation, and packaging work comes from outside contributors rather than only the core Kali team.
Downloading and Upgrading Kali 2026.3
New users can obtain tested installer, live, virtual machine, ARM, cloud, container, and NetHunter images from the official Kali download page. Kali recommends the latest point-release image for most users. Weekly images contain newer packages and can reduce the number of updates needed after installation, but they are automated and do not receive the same quality checks as standard point-release images.
Existing rolling users should first confirm that /etc/apt/sources.list.d/kali.sources points to the official kali-rolling repository with the main, contrib, non-free, and non-free-firmware components. They can then run sudo apt update followed by sudo apt full-upgrade -y. If the system marks a reboot as required, users should restart before checking the result.
The installed release can be checked with grep VERSION /etc/os-release, which should show 2026.3. The active kernel can be checked with uname -r, with the AMD64 release example showing 7.1.5+kali-amd64. The exact kernel string can differ by architecture.
Kali’s update guidance recommends checking for updates every few days or weeks, or sooner when a required tool or security fix is released. It also advises testing all needed tools before a planned security engagement and avoiding updates during active work because a rolling package change can sometimes break a tool at the wrong time
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
