Kali Linux

No entries match these filters. Clear filters

1. Kali Linux 2026.3 Release (Build-Scripts Refresh) (2026-10-26) Oct 26, 2026 · issue 121

   Kali 2026.3 refreshes build-scripts with container support, adds 6 new tools, updates KDE PlasmaKDE PlasmaA desktop environment for Linux and other Unix-like systems, maintained by the KDE community, giving cyber tools a full graphical shell and widget toolkit to build native GUI applications against. to 6.7, and expands NetHunter with WearHunter, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. Arsenal, and KernelSUKernelSUA root solution for Android that operates by patching the Linux kernel directly, giving cyber tools kernel-level privilege without modifying the system partition, which makes detection and revocation harder..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds build-in-container.sh to each refreshed build-script, auto-detecting Docker or Podman to build Kali images inside a container without installing dependencies on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --hostname, --packages, --branch, --variant, and --arch flags to build.sh for customizing Kali installer images at build time.
   • Adds dalfox (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. scanner), katana (crawling/spidering framework), qsreplace (query-string value replacer), rustscan (modern port scanner), sdrangel (Qt-based SDR front-end), and snaffler-ng (SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share credential and sensitive data scanner) to the Kali network repositories.
   • Updates the Kali kernel from 6.19 to 7.1.5 in the 2026.3 release.
   • Adds WearHunter to Kali NetHunter, enabling control of a NetHunter watch from a phone via ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. over Wi-Fi or Bluetooth, including running commands and installing apps.

   +5 more show less

   • Adds NFC Arsenal to Kali NetHunter, enabling reading, cloning, and editing of Mifare classic cards from the Kali chroot without an external adapter.
   • Adds KernelSU support to Kali NetHunter, allowing installation of the generated installer zip via the KernelSU app with a patched kernel.
   • Adds wardriving support for the TicWatch Pro 3 series via an updated libnexmonkali library enabling internal monitor mode, compatible with aircrack-ng suite, kismet, and other chroot tools.
   • Updates KDE Plasma to 6.7, adding per-screen virtual desktops, network connection duplication, and performance/power optimizations for integrated Intel GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference..
   • Adds 9 new NetHunter kernels covering Google Pixel on LineageOS 22.2/Android 15, Huawei P9 on EMUI8/LineageOS 16.0, LG K20 Plus on LineageOS 14.1, Moto G Stylus 5G 2022 on LineageOS 23.2, Nubia Z17 on LineageOS 22.2, POCO X5 5G/Redmi Note 12 5G on crDroid 12, Redmi Note 5 Pro on LineageOS 18.1, Sony Xperia 10 V on LineageOS 23.2, and Ulefone Armor 34+ on Android 16.
   • Adds build-in-container.sh to each refreshed build-script, auto-detecting Docker or Podman to build Kali images inside a container without installing dependencies on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --hostname, --packages, --branch, --variant, and --arch flags to build.sh for customizing Kali installer images at build time.
   • Adds dalfox (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. scanner), katana (crawling/spidering framework), qsreplace (query-string value replacer), rustscan (modern port scanner), sdrangel (Qt-based SDR front-end), and snaffler-ng (SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share credential and sensitive data scanner) to the Kali network repositories.
   • Adds WearHunter to Kali NetHunter, enabling control of a NetHunter watch from a phone via ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. over Wi-Fi or Bluetooth, including running commands and installing apps.
   • Adds NFC Arsenal to Kali NetHunter, enabling reading, cloning, and editing of Mifare classic cards from the Kali chroot without an external adapter.

   +3 more show less

   • Adds KernelSU support to Kali NetHunter, allowing installation of the generated installer zip via the KernelSU app with a patched kernel.
   • Adds wardriving support for the TicWatch Pro 3 series via an updated libnexmonkali library enabling internal monitor mode, compatible with aircrack-ng suite, kismet, and other chroot tools.
   • Adds 9 new NetHunter kernels covering Google Pixel on LineageOS 22.2/Android 15, Huawei P9 on EMUI8/LineageOS 16.0, LG K20 Plus on LineageOS 14.1, Moto G Stylus 5G 2022 on LineageOS 23.2, Nubia Z17 on LineageOS 22.2, POCO X5 5G/Redmi Note 12 5G on crDroid 12, Redmi Note 5 Pro on LineageOS 18.1, Sony Xperia 10 V on LineageOS 23.2, and Ulefone Armor 34+ on Android 16.

   2 more in Everything

2. docs update Sep 22, 2026 · issue 082

   Kali NetHunter Pro brings full desktop-class Kali Linux to ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. mobile devices including PinePhone and Qualcomm hardware⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Kali NetHunter Pro, a pure Kali Linux ARM64 distribution for mobile devices that runs without an Android overlay, supporting PinePhone, PinePhone Pro, Poco F1 (beryllium), OnePlus 6 (enchilada), OnePlus 6T (fajita), Nothing Phone 1 (spacewar), Xiaomi Mi MIX 2S (polaris), and SHIFT SHIFT6mq (axolotl).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports desktop experience via HDMI output on PinePhone and PinePhone Pro, enabling use of a full Kali desktop from a mobile device.
   • Supports dual-boot alongside other operating systems on compatible devices.
   • Provides installation via dd flashing for PinePhone/Pro devices and via fastboot flash (to SD card or eMMC) for Qualcomm Android devices, with A/B partition slot selection using fastboot flash boot_a, fastboot getvar current-slot, and fastboot set_active.

   4 details in Everything

3. Kali Linux 2026.2 Release (GNOME 50, KDE 6.6, Helper Scripts, APT Formats & VM Boot Tweaking) (2026-06-29) Jun 29, 2026 · issue 001

   Kali 2026.2 ships GNOME 50, KDE PlasmaKDE PlasmaA desktop environment for Linux and other Unix-like systems, maintained by the KDE community, giving cyber tools a full graphical shell and widget toolkit to build native GUI applications against. 6.6, unified service helper scripts, new APT sources format, 3x faster VM boot, and 9 new tools.

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Migrate an existing Kali system to the new deb822 APT sources format so APT stops warning about the legacy one-line-style file.
   copy

   $ cat /etc/apt/sources.list.d/kali.sources

   • Upgrades desktop to GNOME 50 with faster file manager thumbnail/icon loading, new accessibility preferences window, automatic language switching, and document annotation support in Document Viewer.
   • Upgrades KDE Plasma to 6.6 with a new on-screen keyboard for touch devices, OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. text extraction directly from screenshots via Spectacle, color-vision support options, Slow Keys on Wayland, and Reduced Motion setting.
   • Introduces standardized <tool>-start / <tool>-stop helper scripts across service-dependent packages, providing consistent service management, status display, default credential info, and automatic browser launch for web UIs.
   • Migrates APT sources from /etc/apt/sources.list to the deb822-style /etc/apt/sources.list.d/kali.sources format on fresh installs, with Signed-By keyring pinning included by default.
   • Removes graphics firmware from pre-built VM images and adds VM detection in the installer to skip graphics firmware, shrinking the initrd from ~200 MB to 60 MB and cutting VM boot time by approximately 3x.

   +3 more show less

   • Makes Linux kernel 7.0 available in kali-experimental (and kali-rolling) for users who want the latest kernel ahead of the default 6.19 shipped in this release.
   • Adds 9 new tools to the Kali repositories: arsenal-ng, hydra-gtk, legba, oletools, penelope, shell-gpt, tailscale, tookie-osint, and uro.
   • Upgrades xrdp and xorgxrdp to the v0.10 series, bringing an updated Remote Desktop Protocol server (reboot required after upgrade).

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Upgrading the polkitd package requires a system reboot; without rebooting, attempting to start GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. applications as root will fail with cryptic error messages.
   • !Upgrading xrdp and xorgxrdp to the v0.10 series requires a system reboot; xrdp may not be functional after the upgrade without rebooting (affects Hyper-V Enhanced Session Mode users as well).
   • !Pre-built VM images no longer include graphics firmware; VMs with dedicated GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. passthrough may lose graphics after upgrade or reinstall without manually installing the required firmware.
4. Kali Linux 2026.1 Release (2026 Theme & BackTrack Mode) (2026-03-24) Mar 24, 2026 · release notes

   Kali Linux 2026.1 adds BackTrack Mode via kali-undercover CLI, 8 new tools, and kernel 6.18

   └──▷ TRY IT
   Switch Kali desktop to BackTrack 5 aesthetic for a legacy look and feel.
   copy

   $ kali-undercover --backtrack

   • kali-undercover --backtrack subcommand to activate BackTrack 5 theme recreation
   • AdaptixC2 post-exploitation framework package
   • Atomic-Operator package for executing Atomic Red Team tests
   • Fluxion social-engineering research tool package
   • GEF modern GDB experience package

   +5 more show less

   • MetasploitMCP MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server package for Metasploit
   • SSTImap automatic SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration. detection tool package
   • WPProbe WordPress plugin enumeration tool package
   • XSStrike advanced XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. scanner package
   • Linux kernel 6.18 upgrade

   10 details in Everything

5. Kali Linux 2025.4 Release (Desktop Environments, Wayland & Halloween Mode) (2025-12-12) Dec 12, 2025 · release notes

   Kali Linux 2025.4 introduces GNOME 49 with Wayland default, bpf-linker, evil-winrm-py, hexstrike-ai, and NetHunter Android 16 support

   └──▷ TRY IT
   Launch the Halloween-themed desktop overlay from the command line.
   copy

   $ kali-undercover --halloween

   • Adds Kali Halloween Mode accessible via kali-undercover --halloween to dress the desktop for the occasion.
   • Introduces GNOME 49 as the default desktop environment with Wayland as the only supported window server (X11 removed).
   • Updates KDE PlasmaKDE PlasmaA desktop environment for Linux and other Unix-like systems, maintained by the KDE community, giving cyber tools a full graphical shell and widget toolkit to build native GUI applications against. to version 6.5, adding fuzzy matching in KRunner, flexible window tiling, and an improved screenshot tool.
   • Adds color theme customization support for Xfce desktop via qt5ct or qt6ct for Qt programs and the Appearance application.
   • Enables VM guest utils (clipboard sharing, window scaling) for Wayland in VirtualBox, VMware, and QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware..

   +7 more show less

   • Distributes the Kali Live image exclusively over BitTorrent due to size exceeding HTTP CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. limits (>5 GB).
   • Adds bpf-linker as a new package for BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. static linking.
   • Adds evil-winrm-py as a new Python-based tool for executing commands on remote Windows machines via WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS..
   • Adds hexstrike-ai as a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server allowing AI agents to autonomously run tools.
   • Updates Kali NetHunter to support Android 16 and adds device support for Samsung Galaxy S10 series (LineageOS 23) and OnePlus Nord.
   • Refreshes Kali NetHunter Terminal app to support any Magisk version with interactive mode and adds Wifipumpkin3 tab preview.
   • Adds four new Kali mirrors: India (mirrors.esto.network), South Korea (mirror2.keiminem.com, mirror.eliv.digital), and USA (mirror.us.cdn-perfprod.com).

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !GNOME 49 removes X11 session support; Wayland is now the default and only window server.
   • !Kali Live image is no longer available via HTTP download; it is distributed over BitTorrent only.
6. Kali Linux 2025.3 Release (Vagrant & Nexmon) (2025-09-23) Sep 23, 2025 · release notes

   Kali Linux 2025.3 adds 10 new tools including Caido and Gemini CLI, Nexmon Wi-Fi support, and CARsenal UI updates.

   • Adds caido (graphical web security auditing toolkit) and caido-cli to Kali Linux.
   • Adds gemini-cli, an open-source AI agent for terminal integration.
   • Adds krbrelayx, a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. relaying and unconstrained delegation abuse toolkit.
   • Adds ligolo-mp, a multiplayer pivoting solution.
   • Adds llm-tools-nmap, enabling LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to perform network discovery via nmap.

   +6 more show less

   • Adds mcp-kali-server, an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration to connect AI agents to Kali.
   • Adds patchleaks, a tool to spot security fixes and provide validation or weaponization details.
   • Adds detect-it-easy (die) for file type identification.
   • Enables monitor mode and injection for Raspberry Pi built-in Wi-Fi via Nexmon firmware support on Broadcom & Cypress chips.
   • Updates configurable VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. IP panel plugin (Xfce) to allow selecting which network interface to monitor.
   • Adds CARsenal UI updates including moved Settings to menu bar, long-press command editing, and new MSF tab for automotive modules.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Drops support for the ARMel architecture; Raspberry Pi 1 and Zero W are no longer supported.
7. The Raspberry Pi's Wi-Fi Glow-Up (2025-07-22) Jul 22, 2025 · release notes

   New brcmfmac-nexmon-dkms and firmware-nexmon packages enable onboard Wi-Fi monitor mode and injection on Raspberry Pi without USB adapters

   └──▷ USE IT
   Install the new Nexmon packages to enable onboard wireless monitor mode and injection on a Raspberry Pi running Kali.
   shell copy

   sudo apt install -y brcmfmac-nexmon-dkms firmware-nexmon

   • Adds the brcmfmac-nexmon-dkms package to provide a DKMS-based brcmfmac driver with Nexmon patches for Broadcom chips.
   • Adds the firmware-nexmon package to supply Nexmon-patched firmware for supported Broadcom Wi-Fi chipsets.
   • Expands on-board wireless assessment support to Raspberry Pi 5, Raspberry Pi 4, Raspberry Pi 3B, Raspberry Pi Zero 2 W, and Raspberry Pi Zero W.

   3 details in Everything

8. Kali Linux 2025.2 Release (Kali Menu Refresh, BloodHound CE & CARsenal) (2025-06-13) Jun 13, 2025 · release notes

   Kali 2025.2 introduces MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. menu organization, CARsenal car hacking set, smartwatch WiFi injection, and new tools like crlfuzz and tinja.

   └──▷ USE IT
   Copy network interface IP directly to clipboard using the newly default-installed xclip utility
   shell copy

   ip a | grep inet | xclip -selection clipboard

   • Kali Menu reorganized to follow MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&ACK framework structure for tool discovery
   • BloodHound Community Edition upgrade with full ingestor set (azurehound, bloodhound-ce-python, sharphound)
   • 13 new tools added: azurehound, binwalk3, bloodhound-ce-python, bopscrk, chisel-common-binaries, crlfuzz, donut-shellcode, gitxray, ldeep, ligolo-ng-common-binaries, rubeus, sharphound, tinja
   • xclip pre-installed across all desktop environments by default
   • New GNOME VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. IP Extension showing connection IP in panel with copy-to-clipboard

   +5 more show less

   • NetHunter on TicWatch Pro 3 supports wireless injection, de-authentication, and WPA2 handshake capture
   • CARsenal car hacking tool set renamed and updated with hlcand, VIN Info, CaringCaribou, ICSim modules
   • New Kali NetKernel for Samsung Galaxy S10 (exynos9820) and Realme C15
   • Raspberry Pi 5 supported by combined 64-bit image; kernel upgraded to 6.12 with brcmfmac nexmon driver
   • Kali NetKeX running on Android radio enabled

   10 details in Everything