Kali Linux 2026.2 ships nine new tools, slashes VM boot times

Kali Linux 2026.2, the second release of the year, arrived June 30 with nine new tools, significant NetHunter updates, and a boot-time overhaul for virtual machine users. The distribution, built for penetration testers and security auditors, continues to refine both its toolset and its underlying performance.

The most notable change targets VM performance: pre-built VM images no longer include graphics firmware, shrinking the initrd from 200 MB to 60 MB and cutting boot time by roughly three times in QEMU tests. Bare-metal installations still ship with the full firmware set.

Nine new tools expand the arsenal

The Kali team added nine tools to the network repositories, covering credential testing, OSINT, shell management, and URL processing:

• arsenal-ng, Go-based command library with 200+ cybersecurity cheat-sheets
• hydra-gtk, Re-added GTK+ GUI for the Hydra network logon cracker
• legba, Multiprotocol credentials bruteforcer, password sprayer, and enumerator
• oletools, Analyzes MS OLE2 files and Office documents for malicious content
• penelope, Powerful shell handler for post-exploitation
• shell-gpt, Command-line productivity tool powered by AI large language models
• tailscale, Secure connectivity platform for zero-trust networking
• tookie-osint, OSINT information gathering tool for finding social media accounts
• uro, Declutters URLs for crawling and penetration testing

The release also updates the services helper scripts, making it easier to manage running services, check status, list default credentials, and access service endpoints.

NetHunter and desktop updates

Kali NetHunter, the Android penetration testing platform, receives a long list of improvements. The app now launches instantly, and the custom commands and chroot manager have been bug-fixed. A new EvilTwin tab adds a Wi-Fi fake access point with a password verification captive portal, accompanied by an iptables fix that ensures Android Hotspot works properly after using Wifipumpkin3 or EvilTwin. Magisk standalone kernel flashing support is now included, allowing users to flash kernel installer zips directly from the Magisk app.

Desktop environments have been refreshed: Kali now ships with GNOME 50 and KDE Plasma 6.6. The kernel has been upgraded to version 6.19, with the 7.0 kernel available in the kali-experimental repository. Users can upgrade existing installations via apt or download fresh ISO images from the Kali website.