The Kali Linux team released version 2026.3 after overhauling the public build scripts it uses to produce every official image. The refreshed scripts share the same features, command-line arguments and, where possible, the same layout, so a pipeline written against an older script may need edits.
Builds can now run in a container
Each refreshed script ships a build-in-container.sh that detects whether you run Docker or Podman, creates a build container and runs the build inside it. That keeps the build dependencies off your host. The team also improved its documentation for building on Debian-based systems.
The kali-installer script shows what a build involves. On a machine with apt, you clone the repository from GitLab, install six build packages (simple-cdd, debian-cd, cpio, mtools, dosfstools and xorriso) and run sudo ./build.sh. The defaults produce a kali-rolling ISO for AMD64. Flags change the hostname, add packages, or switch branch, variant and architecture, as in –branch kali-dev –variant netinst –arch arm64. Automating builds comes next, then examples of different setups and customization.
Kernel, desktop and tools
The release includes 126 package updates, among them a Kali kernel jump from 6.19 to 7.1.5. KDE Plasma 6.7 adds per-screen virtual desktops, useful on multi-monitor setups where you want terminals, Burp and documentation kept apart without switching every display, and it lets you duplicate network connections.
Six tools join the network repositories: dalfox, an XSS scanner; katana, a crawler; qsreplace, which swaps query string values in URLs fed to it; rustscan, a port scanner; sdrangel, a front end for software-defined radio; and snaffler-ng, which scans SMB shares for credentials and sensitive data.
NetHunter adds a smartwatch
Kali NetHunter now supports wardriving, the practice of hunting for wireless networks on the move, from the TicWatch Pro 3 smartwatch. Qazy Anwar updated the libnexmonkali library so the watch’s internal monitor mode works with chroot tools such as the aircrack-ng suite and kismet. NFC access to the Kali chroot lets users read, clone and edit Mifare classic cards without an external adapter, and KernelSU is now supported.
WearHunter, which controls a NetHunter watch from a phone over ADB via Wi-Fi or Bluetooth, is experimental. Nine new kernels cover devices from a Google Pixel on LineageOS 22.2 to the Sony Xperia 10 V.
