Kali Linux 2026.3 has been officially released, bringing six new security tools, updated image-building scripts, KDE Plasma 6.7, and major NetHunter improvements.
Announced on October 26, 2026, this third release of the year includes 126 package updates and upgrades the Linux kernel from version 6.19 to 7.1.5.kali.
This release focuses on customization, making it easier for security professionals to create tailored Kali images while enhancing capabilities for web application testing, network reconnaissance, wireless assessments, and discovering sensitive data.
The following tools are now available in Kali’s network repositories, but may not be included in every installation image:
Kali has standardized features, command-line arguments, structure, and presentation across its refreshed build scripts whenever feasible. These public scripts also generate the distribution’s official images.
Each refreshed script includes build-in-container.sh, which detects Docker or Podman, creates a build container, and executes the build inside it.
This change eliminates the previous practical need to build Kali from an existing Kali installation. Additionally, documentation for Debian-based build environments has been improved.
The installer script defaults to an AMD64 image using the kali-rolling branch. Users can customize hostnames, add packages, or select alternative branches, variants, and architectures via command-line options.
However, the overhaul isn’t complete yet. Developers acknowledged disruptions in CI pipelines and workflows during the transition, and they are targeting Kali 2026.4 to finalize the remaining script updates.
KDE Plasma 6.7 introduces per-screen virtual desktops, allowing multi-monitor users to separate terminals, browsers, Burp Suite, and documentation without switching workspaces across every display simultaneously.
Additional changes include expanded Wayland protocol and portal support, network-connection duplication, System Monitor refinements, and performance improvements involving integrated Intel GPUs and multiple fullscreen windows. Updated application icons also improve tool recognition.
Other changes include Wayland improvements, network connection duplication, refinements to System Monitor, and performance and power-consumption optimizations, particularly for integrated Intel graphics. Tool icons have also been refreshed.
Kali Linux 2026.3 introduces significant updates to NetHunter, the distribution’s mobile penetration testing platform. Key enhancements include better compatibility with older kernels, expanded smartwatch support, NFC access within the Kali chroot, and integration with KernelSU. This release also adds device-specific kernels and resolves various application stability issues.
The update addresses compatibility issues between modern systemd/udev components and older kernels without the need for extensive kernel patches.
This improvement lets NetHunter installations that depend on device-specific kernels run effectively with newer userspace components. However, the announcement does not specify the exact compatibility fixes or guarantee support for all older devices.
The TicWatch Pro 3 series now supports wardriving capabilities thanks to updates to the libnexmonkali library. These changes enable internal Wi-Fi monitor mode for tools operating inside Kali chroot, such as the Aircrack-ng suite and Kismet.
This enhancement extends the watch’s functionality in authorized wireless reconnaissance and assessment workflows. The update also resolves a reboot issue with the TicWatch Pro 3.
WearHunter allows for phone-based control of a NetHunter-equipped watch using Android Debug Bridge (ADB) over Wi-Fi or Bluetooth. Its initial functionalities include running commands and installing applications, which reduces the need for direct interaction with the watch’s small display. Kali describes WearHunter as experimental, with plans for additional features in the future.
NetHunter now offers NFC access within the Kali chroot, enabling supported setups to read, clone, and edit Mifare Classic cards without an external NFC adapter.
This capability enhances authorized access-control assessments. The announcement specifically mentions Mifare Classic, but does not guarantee similar functionality for all NFC card technologies.
KernelSU is now supported, allowing users to install the generated installer ZIP through the KernelSU application when using a patched kernel. This release also introduces initial support for devices without a ramdisk. It adds kernels for various device and operating-system combinations.
| Device | Listed operating-system support |
|---|---|
| Google Pixel | LineageOS 22.2 / Android 15 |
| Huawei P9 | EMUI 8 / LineageOS 16.0 |
| LG K20 Plus | LineageOS 14.1 |
| Moto G Stylus 5G 2022 | LineageOS 23.2 |
| Nubia Z17 | LineageOS 22.2 |
| POCO X5 5G / Redmi Note 12 5G | crDroid 12 |
| Redmi Note 5 Pro | LineageOS 18.1 |
| Sony Xperia 10 V | LineageOS 23.2 |
| Ulefone Armor 34+ | Android 16 |
Additional features include NFC access inside Kali chroot for Mifare Classic operations, KernelSU support, new device kernels, and fixes for storage request crashes.
Fresh installation images are available now. Existing installations can be upgraded through Kali’s rolling repositories using the command: sudo apt update && sudo apt -y full-upgrade.
Users can verify their installed release with the command: grep VERSION /etc/os-release. Weekly images remain available but do not undergo the same quality assurance process as standard releases.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…
Melbourne, Florida, November 5th, 2026, CyberNewswire OpenMatter Network, a pioneer in decentralized infrastructure for agentic…
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China's…