Kali Linux 2026.3: Container Builds, 6 New Tools and More

Kali Linux, the open-source distribution that security teams use for penetration testing and defensive assessments, has released Kali Linux 2026.3, its third release of the year, on October 26, 2026. The theme this time is making Kali easier to build yourself, along with a desktop refresh, six new tools and some genuinely fun Kali NetHunter mobile upgrades.

• Build-scripts refresh: consistent scripts across platforms, plus a new build-in-container.sh that works with Docker or Podman
• Kernel and packages: 126 package updates and a kernel jump from 6.19 to 7.1.5
• New tools: dalfox, katana, qsreplace, rustscan, sdrangel and snaffler-ng
• NetHunter: wardriving on the TicWatch Pro 3 series, adapter-free NFC Mifare Classic support and KernelSU support

Why the Kali Build-Scripts Refresh Matters

Kali has always published the exact scripts it uses to produce every official image. In 2026.3 those scripts now share the same features, command-line arguments and layout across platforms where possible. The bigger quality-of-life win is container support: each refreshed script includes build-in-container.sh, which detects whether you have Docker or Podman, creates the build container and runs the build inside it.

That solves an old chicken-and-egg problem. Kali previously recommended building Kali on Kali; now a security team can generate a custom installer, with its own hostname, extra packages, variant, branch or architecture, from an ordinary machine. For organizations that want reproducible, auditable images for their red and blue teams, that is a meaningful step. The Kali team says not every script was refreshed in time and it is aiming to finish the rest for Kali 2026.4, followed by work on automating builds.

What New Security Tools Are in Kali Linux 2026.3?

The new packages lean toward web application testing and asset discovery, which defenders use to find weaknesses before attackers do:

• dalfox: an open-source, automation-focused XSS scanner
• katana: a next-generation crawling and spidering framework
• qsreplace: replaces query-string values in URLs from stdin, useful in testing pipelines
• rustscan: a modern, fast port scanner
• sdrangel: a Qt-based software-defined radio front end
• snaffler-ng: scans SMB shares for credentials and sensitive data, helping teams spot exposed secrets on their own networks

What's New on the Kali Desktop?

KDE Plasma moves to 6.7, which adds per-screen virtual desktops, handy when you want terminals, a browser, Burp and documentation separated across monitors. Plasma 6.7 also brings performance and power optimizations, especially on integrated Intel GPUs, and lets you duplicate network connections. Kali also refreshed many tool icons in its menu and on kali.org/tools.

What Can Kali NetHunter Do on a Smartwatch?

NetHunter, Kali's mobile platform, gets the most playful updates. Thanks to community contributor work on the libnexmonkali library, the TicWatch Pro 3 series now supports internal monitor mode, so tools such as the aircrack-ng suite and Kismet can run from the Kali chroot for wardriving on your wrist. An experimental WearHunter feature lets you control the watch from your phone over ADB via Wi-Fi or Bluetooth. NetHunter can also now read, clone and edit Mifare Classic NFC cards without an external adapter, supports KernelSU, and gains nine new device kernels.

Community-Built Security Tooling

The release credits a long list of community contributors and adds four new mirrors in Europe, a reminder that a lot of the security industry's essential tooling is maintained in the open. As always, these tools are for authorized testing of systems you own or have permission to assess. If you are upgrading from the last cycle, compare with our look at Kali Linux 2026.2's tools and faster boots, and find more defensive tooling news in our AI security coverage.

Sources: Kali Linux blog — October 26, 2026; Help Net Security — October 26, 2026; BleepingComputer — October 26, 2026.