Kali Linux 2025.4 released with substantial desktop environment improvements, full Wayland support in virtual machines, and three powerful new hacking tools including the much-awaited Wifipumpkin3.
This update, released on December 12, 2025, focuses on modernizing the user experience while maintaining Kali’s position as the leading penetration testing platform. The release brings GNOME 49, KDE Plasma 6.5 and fresh Xfce theming, along with kernel 6.16 and significant infrastructure updates.
GNOME 49 marks an important milestone by becoming completely Wayland-only, removing X11 session support entirely. All variants of Kali have a completely refreshed desktop environment with stunning themes.
Most notably, the old Totem video player has been replaced with Showtime, a modern GTK4-based application that provides a distraction-free viewing experience with chromeless windows and fading controls.
The Application Grid now organizes Kali’s extensive toolkit into folders matching the menu structure, making tool discovery significantly more intuitive. Users also get a long-awaited Terminal shortcut (Ctrl + Alt + T or Win + T), which brings GNOME in line with other desktop environments.
KDE Plasma has reached version 6.5, which includes two major releases’ worth of improvements. Key enhancements include more flexible window tiling, a redesigned screenshot tool with advanced editing features, quick access to clipboard items pinned directly to the panel, and fuzzy matching support in KRunner that finds applications even if they’re misspelled.
Xfce received widespread color theme support for the first time, achieving feature parity with GNOME and KDE. Users can now fully customize colors through the Appearance application for icons, GTK 3/4 windows, and Xfce’s window manager, with Qt programs configurable via qt5ct or qt6ct.
With GNOME’s transition to Wayland-only since Kali Linux 2023.1 and KDE’s long-standing Wayland default, the development team prioritized ensuring seamless virtual machine support.
This release brings full Wayland functionality to VirtualBox, VMware, and QEMU environments, with clipboard sharing and window scaling working flawlessly.
The move addresses the final barrier to Wayland adoption for penetration testers who rely heavily on virtualized environments. All major VM software now fully support Wayland as a guest operating system, eliminating the compatibility concerns that previously kept some users on X11.
Kali 2025.4 introduces three special tools to the network repository:
bpf-linker Serves as a simple static linker for the Berkeley Packet Filter program, which is essential for EBPF-based security tooling.
rogue-winrm-py Provides a Python-based implementation for executing commands on remote Windows machines via the Windows Remote Management protocol. The tool supports multiple authentication methods including NTLM, pass-the-hash, certificate-based authentication, and Kerberos, along with features like file upload/download, command history, and colored output.
Hexstrike-AI An MCP serves as a server that enables AI agents to run security tools autonomously, representing an important step toward AI-assisted penetration testing workflows.
The kernel has been upgraded to version 6.16, which brings performance improvements, USB audio offload support, XFS large atomic writes, and optimized compilation options for local CPU architectures.
WiFipumpkin3 integration enhances wireless testing
Although not one of the three “new” tools, WiFipumpkin3 has received significant attention in this release through enhanced NetHunter integration. The powerful rogue access point framework supports Evil Twin attacks, captive portal credential harvesting, DNS spoofing, traffic interception, and custom phishing pages.
The NetHunter app now includes a Wifipumpkin3 Preview tab with updated community templates, including phishing pages for Facebook, Instagram, iCloud, and Snapchat.
Built in Python and using GStreamer, Wifipumpkin3 enables comprehensive wireless network auditing through man-in-the-middle attacks and transparent proxies.
NetHunter expands Android 16 support
Kali NetHunter brings comprehensive mobile updates, including Android 16 support for the Samsung Galaxy S10 family (S10, S10e, S10 Plus and S10 5G) running LineageOS 23, with CAN bus support and internal wireless injection capabilities. OnePlus Nord also gets Android 16 compatibility, while Xiaomi Mi 9 now supports Android 15
Following community efforts the Terminal app has been restored to full functionality, now supporting all Magisk versions with interactive mode, preventing CTRL+C from closing a Terminal session. Magisk Installer now supports module installation, installed kernel modules appear in the Modules tab
The live image now exceeds the 5GB Cloudflare CDN limit and is now available as a BitTorrent download only, joining EverythingImage. At 4.7GB, the live image includes a fully functional pre-installed Kali system compressed with xz, as well as the installer and minimal package pool.
A hidden seasonal feature, Halloween Mode, remains accessible via commands black-undercover-halloweenDecorating the desktop with a themed aesthetic. The standard Kali Undercover Mode continues to provide a Windows 10-like theme to work discreetly in public places.
Fresh images are available via official download The channels provide the latest packages with weekly builds for those who can’t wait for the next quarterly release.
┌──(kali㉿kali)-[~]
└─$ echo "deb kali-rolling main contrib non-free non-free-firmware" | sudo tee /etc/apt/sources.list
[...]┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt -y full-upgrade
[...]┌──(kali㉿kali)-[~]
└─$ cp -vrbi /etc/skel/. ~/
[...]┌──(kali㉿kali)-[~]
└─$ [ -f /var/run/reboot-required ] && sudo reboot -f
Existing installations can upgrade via standard package management commands, bringing the system to kernel 6.16.8-1 Kali1.
┌──(kali㉿kali)-[~]
└─$ grep VERSION /etc/os-release
VERSION="2025.4"
VERSION_ID="2025.4"
VERSION_CODENAME="kali-rolling"┌──(kali㉿kali)-[~]
└─$ uname -v
#1 SMP PREEMPT_DYNAMIC Kali 6.16.8-1kali1 (2025-09-24)┌──(kali㉿kali)-[~]
└─$ uname -r
6.16.8+kali-amd64
The Kali team has expanded its mirror infrastructure with three new Asian mirrors in India and South Korea, as well as an additional North American mirror, improving download speeds and global availability.
What should I follow Google News, LinkedinAnd x For daily cyber security updates. Contact us to get your stories featured.