Loading story…
Kali Linux has released version 2025.4, introducing three new security tools—bpf-linker, evil-winrm-py, and hexstrike-ai—alongside significant updates to its desktop environments. The GNOME desktop has been upgraded to version 49, featuring refreshed themes, a new Showtime video player, reorganized tool folders, and the complete transition to Wayland as the default and only window server. KDE Plasma has been updated to version 6.5, bringing improved window tiling, a new screenshot tool, enhanced clipboard access, and fuzzy search in KRunner. The Xfce desktop now supports color themes, further enhancing user customization. Additional quality-of-life improvements include new keyboard shortcuts for quickly opening a terminal across all desktop environments.
These updates aim to improve usability and performance for cybersecurity professionals and ethical hackers who rely on Kali Linux for penetration testing, red-teaming, and security assessments. The release also maintains strong support for a wide range of hardware, including Raspberry Pi devices and Android phones via Kali NetHunter. The focus remains on delivering essential enhancements and new capabilities without unnecessary additions, ensuring Kali Linux continues to serve as a robust platform for security research and operations.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Due to the increased size of the live image, Kali Linux 2025.4 changed distribution of the Kali Live image to BitTorrent only. The release also added new community mirrors in Asia and North America to improve download availability.
The 2025.4 release expanded Kali NetHunter support to additional devices and added Android 16 support on more hardware. It also improved terminal compatibility and strengthened integration with wireless attack tooling.
With Kali Linux 2025.4, GNOME 49 became Wayland-only with X11 support removed, while KDE Plasma 6.5 and Xfce also received major updates and theming improvements. The release further improved Wayland support across major virtualization platforms.
The 2025.4 release introduced bpf-linker, evil-winrm-py, and hexstrike-ai to expand penetration testing, red-teaming, and eBPF security capabilities. Multiple reports also highlight Wifipumpkin3 enhancements and tighter integration with NetHunter in this release.
OffSec released Kali Linux 2025.4 on December 12, 2025, as the final Kali update of the year. The release includes desktop environment upgrades, quality-of-life improvements, kernel and infrastructure updates, and refreshed documentation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcekali.org
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kali Linux 2025.3 delivers new security tools, improved ARM and Raspberry Pi support, and significant infrastructure enhancements. The release includes 10 new tools, Nexmon support for monitor and injection modes on Raspberry Pi 5, and the discontinuation of ARMel architecture support. Additional updates include a revamped VPN IP panel plugin, expanded NetHunter features, and increased mirror bandwidth for faster package distribution.
Jun 29, 2026
Kali Linux published documentation for an **AI-assisted penetration testing workflow** that uses Anthropic’s **Claude Desktop** as a natural-language interface and the open-source **Model Context Protocol (MCP)** to translate prompts into tool execution on a Kali host. The described architecture separates a GUI “UI layer” (Claude Desktop on macOS/Windows), an “execution layer” (a Kali system running an `mcp-kali-server` bridge that exposes tools), and an “intelligence layer” (Anthropic’s *Claude Sonnet 4.5* in the cloud). The goal is to let operators request tasks like port scanning and web checks in plain language, with the LLM planning and iterating through tool calls while returning structured results. This is **not an incident report** but a capability/workflow enablement that can materially change how offensive tooling is orchestrated, including by lowering the operational friction of chaining common recon and enumeration steps. Organizations evaluating similar agentic workflows should treat the MCP bridge and any AI agent runtime as a privileged automation surface (credentials, tokens, tool execution, and output handling), and consider isolation and least-privilege controls when experimenting with LLM-driven command execution in security tooling environments.
Jun 29, 2026
Kali Linux published a new installment in its LLM-driven workflow series showing how to run **LLM-assisted penetration testing fully offline/on-prem** by hosting the model, context/tooling layer, and client locally. The walkthrough uses **Ollama** (a local model runner) plus **5ire** as a desktop client, emphasizing operational security and privacy benefits versus cloud-hosted AI services, and noting the primary tradeoff is **GPU hardware and power cost** rather than SaaS subscriptions. The guide demonstrates an NVIDIA CUDA-based setup on a **GeForce GTX 1060 (6GB VRAM)**, including replacing the open-source `nouveau` driver with proprietary **non-free NVIDIA drivers** to enable CUDA acceleration and validating the environment with `nvidia-smi` after reboot. In parallel, SentinelOne published separate research on using **LLMs for cyber threat intelligence (CTI) information extraction**, describing how models can convert narrative reports into structured data (e.g., IOCs and relationships) and discussing evaluation tradeoffs; this is adjacent AI-in-security content but not part of the Kali local pentesting stack or its implementation details.
Jun 29, 2026