Kali Linux 2026.3: six new tools and kernel 7.1.5

The Kali Linux team has released version 2026.3, the third of the year according to BleepingComputer. The penetration testing and red teaming distribution brings 126 updated packages, a kernel jump from 6.19 to 7.1.5, six new tools in the repositories, KDE Plasma 6.7 and reworked build scripts that can now run inside a container. Kali NetHunter, the mobile edition, gains smartwatch wardriving and reading of Mifare Classic NFC cards without external adapters. The release was covered by BleepingComputer, Help Net Security and heise Security; for heise we could only consult the headline, which confirms easier image builds and smartwatch wardriving.

This is not a vulnerability and there are no CVEs: it is a release. We cover it because Kali’s tools are the same ones used by red teams, consultants and, often, attackers: knowing what goes into the toolbox helps you understand what to look for in your own logs.

The six new tools

According to both sources, the repositories now include:

• dalfox: an XSS vulnerability scanner built for automation;
• katana: a web crawling and spidering framework;
• qsreplace: reads URLs and replaces query string parameter values with a chosen value, handy for preparing tests in bulk;
• rustscan: a port scanner;
• sdrangel: a Qt graphical front end for SDR (software-defined radio) devices;
• snaffler-ng: searches SMB shares for credentials and sensitive data.

For defenders, the most relevant are snaffler-ng and rustscan. The former automates a typical post-access step: exploring Windows network shares for forgotten passwords, keys and configuration files. In our MITRE ATT&CK mapping it corresponds to Network Share Discovery (T1135) and Unsecured Credentials: Credentials In Files (T1552.001); rustscan to Network Service Discovery (T1046). katana, qsreplace and dalfox serve reconnaissance and testing of exposed web applications (Active Scanning, T1595).

Kernel, desktop and upgrading

The kernel moves from 6.19 to 7.1.5. KDE Plasma 6.7 introduces separate virtual desktops per screen, the ability to duplicate network connections and, according to BleepingComputer, better power usage on integrated Intel GPUs and improved support for Wayland protocols.

To upgrade an existing installation, BleepingComputer reports the procedure given by the project: the kali-rolling repository in /etc/apt/sources.list, then sudo apt update && sudo apt -y full-upgrade, and finally a check with grep VERSION /etc/os-release.

Reworked build scripts and containerised builds

The most substantial change concerns the public scripts the team uses to produce every official image. They now share the same features, the same command-line arguments and, where possible, the same structure. Help Net Security warns that a pipeline written against the old scripts may need edits.

Each refreshed script includes build-in-container.sh, which detects Docker or Podman, creates the build container and runs the build inside it, without installing dependencies on the host. The example given by Help Net Security is kali-installer: clone the repository from GitLab, install six packages (simple-cdd, debian-cd, cpio, mtools, dosfstools, xorriso) and run sudo ./build.sh. The defaults produce a kali-rolling ISO for AMD64; options change hostname, packages, branch, variant and architecture (for example --branch kali-dev --variant netinst --arch arm64). According to BleepingComputer not all scripts have been refreshed yet: the goal is to finish them for Kali 2026.4, then automate builds and workflows.

NetHunter: smartwatch wardriving and NFC

According to Help Net Security, NetHunter now supports wardriving, i.e. hunting for wireless networks on the move, from the TicWatch Pro 3 smartwatch: the libnexmonkali library, updated by Qazy Anwar, makes the internal Wi-Fi chip’s monitor mode usable with chroot tools such as the aircrack-ng suite and kismet. NFC access from the chroot lets users read, clone and edit Mifare Classic cards without an external adapter, and KernelSU is supported. WearHunter, which controls the watch from a phone over ADB via Wi-Fi or Bluetooth, is experimental. Nine new kernels cover devices ranging from a Google Pixel on LineageOS 22.2 to the Sony Xperia 10 V.

What it means for European and Italian organisations

None of these changes is an attack, but some activities become easier. Wi-Fi reconnaissance from a watch is less conspicuous than a laptop with an external antenna; cloning Mifare Classic cards from a phone matters to anyone still using this technology, whose cryptographic weaknesses have been known for years, for physical access badges. Automated credential hunting in SMB shares targets a very common problem in corporate networks.

For NIS2 entities (in Italy, Legislative Decree 138/2024), assessing the effectiveness of security measures is part of risk management: authorised use of the same tools red teams use, on your own network, is a concrete way to do it. The same applies to healthcare, where network shares and badges are often inherited from years past.

What to do now

1. Look first, before others do, for credentials and sensitive data in SMB shares, through an authorised and documented exercise; remove what you find and rotate exposed credentials.
2. Check detection of share discovery and internal port scans: a single host enumerating many shares or many ports in a short time should raise an event.
3. Review badges: if you still use Mifare Classic cards for physical access, consider moving to stronger technologies.
4. Verify wireless networks: enterprise authentication, separate guest networks, no undeclared networks.
5. If you build Kali images for your red team, check your pipelines: script arguments and structure have changed.

How ARXDOME helps

ARX Radar recognises fast and slow port scans against your public addresses, while ARX Scout and ARX Expose show which ports and services are actually exposed, i.e. what a scanner would see from outside. Internally, ARX Sentry’s SOC pages report logons, failures and events mapped to MITRE ATT&CK, and ARX Watch flags new or unauthorised devices appearing on the network.

Last updated: 27 October 2026