Loading story…
Kali Linux 2025.3 delivers new security tools, improved ARM and Raspberry Pi support, and significant infrastructure enhancements. The release includes 10 new tools, Nexmon support for monitor and injection modes on Raspberry Pi 5, and the discontinuation of ARMel architecture support. Additional updates include a revamped VPN IP panel plugin, expanded NetHunter features, and increased mirror bandwidth for faster package distribution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CISA updated its Known Exploited Vulnerabilities catalog files in a commit to the kev-data repository. The commit indicates changes to the KEV dataset were published that day.
Offensive Security released Kali Linux 2025.3, introducing the new version of the penetration testing distribution. Coverage highlights improved virtual machine tooling, Wi-Fi-related enhancements, and the addition of 10 new tools.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourcegithub.com
Open sourcekali.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kali Linux has released version 2025.4, introducing three new security tools—`bpf-linker`, `evil-winrm-py`, and `hexstrike-ai`—alongside significant updates to its desktop environments. The GNOME desktop has been upgraded to version 49, featuring refreshed themes, a new Showtime video player, reorganized tool folders, and the complete transition to Wayland as the default and only window server. KDE Plasma has been updated to version 6.5, bringing improved window tiling, a new screenshot tool, enhanced clipboard access, and fuzzy search in KRunner. The Xfce desktop now supports color themes, further enhancing user customization. Additional quality-of-life improvements include new keyboard shortcuts for quickly opening a terminal across all desktop environments. These updates aim to improve usability and performance for cybersecurity professionals and ethical hackers who rely on Kali Linux for penetration testing, red-teaming, and security assessments. The release also maintains strong support for a wide range of hardware, including Raspberry Pi devices and Android phones via Kali NetHunter. The focus remains on delivering essential enhancements and new capabilities without unnecessary additions, ensuring Kali Linux continues to serve as a robust platform for security research and operations.
Jun 29, 2026
Kali Linux published a new installment in its LLM-driven workflow series showing how to run **LLM-assisted penetration testing fully offline/on-prem** by hosting the model, context/tooling layer, and client locally. The walkthrough uses **Ollama** (a local model runner) plus **5ire** as a desktop client, emphasizing operational security and privacy benefits versus cloud-hosted AI services, and noting the primary tradeoff is **GPU hardware and power cost** rather than SaaS subscriptions. The guide demonstrates an NVIDIA CUDA-based setup on a **GeForce GTX 1060 (6GB VRAM)**, including replacing the open-source `nouveau` driver with proprietary **non-free NVIDIA drivers** to enable CUDA acceleration and validating the environment with `nvidia-smi` after reboot. In parallel, SentinelOne published separate research on using **LLMs for cyber threat intelligence (CTI) information extraction**, describing how models can convert narrative reports into structured data (e.g., IOCs and relationships) and discussing evaluation tradeoffs; this is adjacent AI-in-security content but not part of the Kali local pentesting stack or its implementation details.
Jun 29, 2026
Kali Linux published documentation for an **AI-assisted penetration testing workflow** that uses Anthropic’s **Claude Desktop** as a natural-language interface and the open-source **Model Context Protocol (MCP)** to translate prompts into tool execution on a Kali host. The described architecture separates a GUI “UI layer” (Claude Desktop on macOS/Windows), an “execution layer” (a Kali system running an `mcp-kali-server` bridge that exposes tools), and an “intelligence layer” (Anthropic’s *Claude Sonnet 4.5* in the cloud). The goal is to let operators request tasks like port scanning and web checks in plain language, with the LLM planning and iterating through tool calls while returning structured results. This is **not an incident report** but a capability/workflow enablement that can materially change how offensive tooling is orchestrated, including by lowering the operational friction of chaining common recon and enumeration steps. Organizations evaluating similar agentic workflows should treat the MCP bridge and any AI agent runtime as a privileged automation surface (credentials, tokens, tool execution, and output handling), and consider isolation and least-privilege controls when experimenting with LLM-driven command execution in security tooling environments.
Jun 29, 2026