Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

236 notes across 54 products and five days, up from 157 — and unusually, the volume is not the story. Four separate things shipped as coordinated multi-product launches rather than as single notes, which makes the week read very differently from its inventory. Service rate limiting appeared in Cloud Armor, Secure Web Proxy and regional internal Application Load Balancers on the same day. Private Service Connect became the default private IP option for new instances across all three Cloud SQL engines. Google-managed certificate lifetimes began halving, announced twice. Spend caps went GA in Cloud Billing and Cloud Run together. Meanwhile the security bulletins feed produced two items after producing none for three weeks, and the pair of them make a useful point about reading severity.

Two bulletins, and why severity does not tell you whether to act

The two bulletins this week are rated Critical and High, and the Critical one is the one you can ignore. That inversion is worth sitting with, because the instinct to triage by severity gets it exactly backwards here.

GCP-2026-068, published 14 October and rated Critical, is an Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. The impact is as bad as the rating suggests: an authenticated user could escalate privileges and impersonate a service account in the Google Cloud project. And the instruction is one line — no customer action is required. This vulnerability was patched on August 27, 2026. It carries CVE-2026-85298.

GCP-2026-067, published 12 October and rated High, is a Denial-of-Service (DoS) vulnerability was discovered in Envoy Proxy when an HTTP filter — specifically one that mutates the :path header after route selection on a route configured with prefix_rewrite. This one does not say no action is required. It says for instructions and more details, see the Cloud Service Mesh security bulletin, and it is tracked upstream as envoyproxy/envoy#47841 rather than under a CVE.

One factual pattern alongside it, since this series tracks the bulletins feed week to week: GCP-2026-068 is the third consecutive Application Integration bulletin, after GCP-2026-066 and GCP-2026-065 on 28 September. All three describe an authenticated user reaching further than they should — privilege escalation here, a confused deputy and an untrusted-deserialisation issue in the previous pair. That is an observation about where disclosures are landing, not a judgement about the product.

Service rate limiting arrives in three products at once

The week's most substantial new capability was published three times on 14 October, once per surface it applies to. Service rate limiting policies are now available in Preview for regional internal Application Load Balancers and Secure Web Proxies, and the purpose is stated more precisely than "rate limiting" usually is: service rate limiting policies let you maintain service availability among trusted clients that might consume an inordinate amount of resources.

That phrase is the whole design. This is not abuse prevention — Cloud Armor already does that for untrusted traffic. It is protection against your own well-behaved clients, the internal consumer whose retry loop or batch job is indistinguishable from a healthy caller except in volume. Hence the surfaces it landed on: Secure Web Proxy supports service rate limiting policies, applying to Secure Web Proxy gateways whether they use an authorization policy or a gateway security policy, and separately Cloud Armor supports service rate limiting, also in Preview.

Worth noting what the internal load balancer case gives you that the previous four architecture posts could not. Those posts established that a subnet boundary carries no policy, that firewall rules are enforced at the VM, and that there is no choke point between subnets to inspect. A rate limiting policy on a regional internal Application Load Balancer is a choke point — a place in the path where a quantitative policy about a trusted caller can be enforced. It is the first thing in this block of the series that behaves like the mid-network control the model otherwise lacks.

Private Service Connect becomes the Cloud SQL default

On 13 October the same sentence was published under Cloud SQL for MySQL, Cloud SQL for PostgreSQL and Cloud SQL for SQL Server: private Service Connect is now the default private IP connectivity option when you create a Cloud SQL for MySQL instance in a new Google Cloud project, and likewise for a Cloud SQL for PostgreSQL instance and a Cloud SQL for SQL Server instance. The stated advantages are reach and automation — it lets you connect from multiple VPC networks across different groups, projects or organizations, and it supports automatic endpoint and DNS record provisioning.

Two qualifiers deserve emphasis because they bound the change tightly. It applies to new instances in new projects, so nothing existing moves. And it is a default rather than a requirement — when you configure private IP for an instance you can still choose private services access instead.

Certificates halve to 45 days, and you do nothing

Announced twice on 14 October, under Certificate Manager and again under Cloud Load Balancing: Google-managed public SSL certificates signed by Google Public CA (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security. Half the lifetime means twice the rotations, and Google-managed public certificates now rotate more frequently as a result; Google frames the benefit as the obvious one, that this proactive rotation enhances the overall security posture of load balancers.

The important half of the note is the part that is easy to skip past, and it is the reason this is not an action item: transition requires no manual intervention or configuration changes as Google Cloud automatically manages issuance and renewal for both Certificate Manager and Compute Engine SSL certificates. Both certificate surfaces, issuance and renewal, handled. For almost everybody this is a change you will never observe.

The exception is anything of yours that encoded 90 days as a fact rather than reading it from the certificate — a monitoring threshold that alerts when expiry is more than so many days out, a compliance export that records certificate lifetime, a dashboard panel with a hardcoded renewal window. Those do not break; they quietly start describing something that is no longer true, which is the same failure mode as every other item in this week's roundup.

Networking, platform and the rest

Cloud DNS gained outbound endpoints. Outbound Endpoints for Cloud DNS is available in Preview, and the mechanism is specific: attach Outbound Endpoints to forwarding zones or server policies to enable direct DNS query forwarding from VPC networks to external and on-premises DNS resolvers using private IP addresses. For hybrid resolution this is the piece that previously needed an inbound forwarding relay on the other side.

VPC Service Controls learned about GKE workload identity. Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resources protected by a service perimeter is available in Preview, and the granularity is per service account, per namespace — all GKE Pods in a Kubernetes namespace — or per cluster. A perimeter rule can now name a Kubernetes identity rather than the project around it. The accompanying blog post, Modernizing perimeter security: Scalable perimeters with VPC Service Controls, landed on 15 October.

Load balancing and networking fixes. Regular expression matchers in host and route rules in URL maps are now generally available (GA). And a billing correction worth checking if it affected you: the technical issue causing incorrect billing for producer VPC spokes has been fixed in Network Connectivity Center.

Compute. Generally available: the network-optimized C4N machine types with 375 GiB to 12,000 GiB of attached Titanium SSD are now generally available. Hyperdisk volumes in multi-writer mode can now be grown while attached to multiple instances, and regional read-only views of global project and image resources went GA.

Cost controls, in two products. Spend cap budgets are now generally available for a limited set of services, and alongside it support for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA). A budget that pauses workloads rather than emailing somebody is a materially different control from a budget alert.

One deprecation to note, in two APIs. The emotion label response in the Cloud Vision API is deprecated and face detection will return UNKNOWN for all emotion-related labels; the Video Intelligence API published the equivalent note the same week. Anything consuming emotion labels now receives UNKNOWN rather than an error, so the failure is silent by design.

What I would act on

1. Check whether your Envoy configuration matches GCP-2026-067, and follow the Cloud Service Mesh bulletin. This is the one bulletin of the two that asks something of you. The trigger is specific — an HTTP filter that mutates the :path header after route selection on a route with prefix_rewrite — so it is answerable by inspection rather than guesswork.
2. Find anything that hardcodes a 90-day certificate lifetime. Monitoring thresholds, compliance exports, dashboards. The rotation itself needs no intervention; the assertions you wrote about it do.
3. Decide your Cloud SQL private connectivity standard before the next new project. The default is now Private Service Connect for new instances in new projects, private services access is still selectable, and the cheapest moment to make that an explicit choice is before two projects diverge by accident.
4. If you run internal services with trusted but noisy clients, try service rate limiting in Preview. It is the first control in this area aimed at well-behaved callers consuming too much, rather than at abuse, and it sits in the request path where nothing else in the VPC model does.
5. Audit anything reading emotion labels from Cloud Vision or Video Intelligence. It will not error. It will return UNKNOWN, which a downstream consumer may happily record as a result.

Complete inventory — all 236 notes

How this inventory reconciles

Google Cloud published 236 notes across 54 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (23 notes) — Fixed23 notes, across 3 releases (cos-121-18867-638-5, cos-125-19216-739-5, cos-dev-138-20198-0-0). 20 distinct texts, each repeated once per release and counted individually:
  • Added support for lustre v2.14.0_p262-r1
  • Added support for net-fs/lustre-client-drivers v2.14.0_p262-r1
  • Added support for net-fs/lustre-client-drivers v2.14.0_p262.
  • Added the "watchdog_timeout" module parameter to the idpf driver.
  • Updated app-admin/google-guest-configs to v20260928.00.
  • Upgraded app-admin/google-guest-configs to v20260928.00.
  • Upgraded app-admin/oslogin to v20260924.00.
  • Upgraded app-admin/oslogin to v20261006.00.
  • Upgraded app-arch/gzip to v1.15.
  • Upgraded app-containers/runc to v1.5.2, Upgraded app-containers/runc-test to v1.5.2.
  • Upgraded dev-libs/expat to v2.8.5.
  • Upgraded dev-libs/expat to v2.9.0.
  • Upgraded dev-libs/libgcrypt to v1.12.4.
  • Upgraded dev-libs/libpcre2 to v10.49.
  • Upgraded dev-libs/xxhash to v0.8.3-r2.
  • Upgraded dev-python/oauthlib to v4.0.0.
  • Upgraded net-misc/openssh to v10.4_p1-r1.
  • Upgraded sys-apps/less to v710.
  • Upgraded sys-apps/pv to v1.12.0.
  • Upgraded sys-apps/xemu to v0.0.11.
• Container Optimized OS (14 notes) — Security14 notes, across 3 releases (cos-121-18867-638-5, cos-125-19216-739-5, cos-dev-138-20198-0-0). They fix 3 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-18220, CVE-2026-49264, CVE-2026-5450.

One change, published under several products

• FixedThe following issues were fixed in 1.35.600-gke.141: Fixed vulnerabilities listed in Vulnerability fixes .Published under 2 products: Google Distributed Cloud (software only) for VMware, Google Distributed Cloud (software only) for bare metal.
• FeatureApplied Threat Intelligence curated rules now use the GTI_IOC feed As a follow-up to the release of the GTI_IOC feed and the deprecation of the legacy MANDIANT_…Published under 2 products: Google SecOps, Google SecOps SIEM.
• AnnouncementThe deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027. For more information, refer to S…Published under 2 products: Google SecOps, Google SecOps SOAR.

Everything else, by product

Agent Platform Workbench — 6

• Change20261011.00_p0 ReleaseMon 12 Oct · 20261011.00_p0
• ChangeInstalled latest packages from upstream dependencies.Mon 12 Oct · 20261011.00_p0
• Change20261011.00_p0 ReleaseMon 12 Oct · 20261011.00_p0
• ChangeInstalled latest packages from upstream dependencies.Mon 12 Oct · 20261011.00_p0
• FixedFixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography.Mon 12 Oct · 20261011.00_p0
• FixedFixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography.Mon 12 Oct · 20261011.00_p0

Anti Money Laundering AI — 1

• AnnouncementNew minor engine version released for the commercial line of business within the v004.011 version line ( aml-commercial.default.v004.011.202610-000 ). This vers…Wed 14 Oct

Apigee Edge for Private Cloud — 11

• AnnouncementReleased Apigee Edge for Private Cloud 4.54.00. Designated Apigee Edge for Private Cloud 4.54.00.00 a long-term support (LTS) release: 18 months of full support…Thu 15 Oct
• AnnouncementThis release replaces Java 8 with Java 17 and Java 21, removes the Classic UI and the apigee-sso component, and updates the bundled Cassandra, Postgres, OpenLDA…Thu 15 Oct
• AnnouncementReplaced the Classic UI ( edge-ui ) with the New Edge UI ( edge-management-ui ). The New Edge UI is the only management UI in 4.54.00 and is installed by defaul…Thu 15 Oct
• BreakingIn deployments with Apigee SSO enabled, an integrated OIDC identity broker in apigee-openldap replaces the standalone apigee-sso component and Apache Tomcat 9.0…Thu 15 Oct
• Breaking4.54.00 runs Java in mixed mode: Java 17 for Cassandra and ZooKeeper, Java 21 for the Management Server, Message Processor, Router, and Qpid Broker-J. Both Orac…Thu 15 Oct
• ChangeUpgraded Nginx on the Edge Router to 1.30.0. If you are upgrading from Nginx 1.20.x, see Nginx 1.30 changes in Apigee Edge 4.54.00 for the full list of changes.Thu 15 Oct
• ChangeChanged the TLS defaults on Message Processors to the Java 21 cryptographic baseline. Message Processors run on Java 21, which enables TLS 1.3 by default ( JEP…Thu 15 Oct
• ChangeChanged the default garbage collector on Message Processors to the Garbage-First garbage collector. Message Processors set useG1GC=true and useStringDeduplicati…Thu 15 Oct
• FeatureAdded Basic authentication to the New Edge UI, which lets you sign in without configuring an identity provider. The New Edge UI supports Basic authentication wi…Thu 15 Oct
• FeatureAdded automated pre-flight validation checks to apigee-setup and apigee-service , which surface environment configuration problems before a component is install…Thu 15 Oct
• SecurityFixed multiple security vulnerabilities in Apigee Edge for Private Cloud 4.54.00. These fixes ship as part of the component upgrades in this release; see Change…Thu 15 Oct

Apigee Edge for Public Cloud — 2

• AnnouncementOn October 15, 2026, we began releasing Single Sign-On (SSO) updates for Apigee Edge for Public Cloud.Thu 15 Oct
• FixedBug ID Component Description 560310696 SSO Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now…Thu 15 Oct

Apigee Integrated Portal — 2

• AnnouncementOn October 15, 2026, we released a new version of the Apigee integrated portal.Thu 15 Oct
• FixedBug ID Description 560310696 Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enfor…Thu 15 Oct

Apigee X — 1

• FixedBug ID Description 466116259 Updated the startup script for the managed instance group (MIG) that routes external traffic to Apigee. net.ipv4.ip_forward is now…Thu 15 Oct

Apigee hybrid — 3

• Announcementv1.16.11 On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11. For information on upgrading, see Upgrading Apigee hybrid t…Wed 14 Oct · v1.16.11
• FixedFixed in this release Bug ID Description 565072374 Fixed an issue where VerifyJWT policies using a JWKS uriRef could return steps.jwt.NoMatchingPublicKey on the…Wed 14 Oct · v1.16.11
• SecurityBug ID Description N/A Security fixes for apigee-fluent-bit . This addresses the following vulnerabilities: CVE-2026-35189 CVE-2026-35191 CVE-2026-42772 CVE-202…Wed 14 Oct · v1.16.11

Application Integration — 2

• SecurityStarting October 15, 2026, Application Integration enforces security fixes for IAM, run-as service accounts, and iam.serviceAccounts.actAs checks, requiring the…Mon 12 Oct
• SecurityAn Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27,…Wed 14 Oct

Backup for GKE — 1

• ChangeBackup for GKE is now available in the following region: asia-southeast3 (Bangkok, Thailand). For more information, see Backup for GKE locations .Mon 12 Oct

BigQuery — 12

• FeatureIncremental data transfers for the BigQuery Data Transfer Service for PostgreSQL and ServiceNow are now generally available (GA).Mon 12 Oct
• FeatureThe AI.AGG function is generally available (GA). You can use this function to semantically aggregate unstructured input data based on natural language instructi…Tue 13 Oct
• FeatureBigQuery generative AI functions now support the gemini-4-argon model. This model is generally available .Tue 13 Oct
• FeatureThe Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA). This integration lets you use the metastore as a serverless,…Wed 14 Oct
• FeatureMetadata migration from Dataproc Metastore to Lakehouse is now generally available (GA). You can perform a one-time backfill migration or dry run to migrate met…Wed 14 Oct
• FeatureConversational analytics now lets you create a conversation with all of the data sources in multiple projects, or create a conversation with a dataset . These f…Wed 14 Oct
• FeatureYou can publish a BigQuery Conversational Analytics agent in Gemini Enterprise . This feature is now generally available (GA).Wed 14 Oct
• FeatureThe AI.AGG function now supports the output_schema argument, which lets you specify the schema of the function output as a comma-separated list of fields. This…Wed 14 Oct
• FeatureYou can copy tables across regions . This feature is now generally available (GA).Thu 15 Oct
• FeatureYou can now use column aliases in GoogleSQL. This feature lets you define an alias for an expression in the SELECT clause of a SQL query and immediately referen…Thu 15 Oct
• FeatureYou can export a conversational analytics agent's answer , including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is generall…Thu 15 Oct
• FeatureConversational analytics in BigQuery is now available in the following locations: northamerica-northeast1 (Montréal) northamerica-northeast2 (Toronto) For more…Fri 16 Oct

Blog — 20

• PostIntroducing TimesFM 3.0 with multivariate time-series forecasting in BigQueryMon 12 Oct
• PostCross-cloud conversational analytics made simple with open standardsTue 13 Oct
• PostGemini 4 Argon available on Google Cloud, built to help solve your business’ hardest problemsTue 13 Oct
• PostOne Agent Development Kit, five languagesTue 13 Oct
• PostPredictable AI spend in BigQuery: Introducing cost management for generative AI functionsWed 14 Oct
• PostCloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQCWed 14 Oct
• PostTemporal Serverless Workers on Cloud Run: Scale workers ahead of demandThu 15 Oct
• PostWhat the Gemini agent means for startupsThu 15 Oct
• PostBringing the borderless Lakehouse into the agentic era with innovations for GeminiThu 15 Oct
• PostModernizing perimeter security: Scalable perimeters with VPC Service ControlsThu 15 Oct
• PostWhat’s new with Google Data CloudThu 15 Oct
• PostHow Visko streams real-time world models on Google Cloud TPUsThu 15 Oct
• PostARMORY CASTLE Exploits BeyondTrustThu 15 Oct
• PostInvestigating Ephemeral Supply Chain TamperingThu 15 Oct
• PostDay 0 support for Reflection’s Beam on Google Cloud: 5x faster perf with llm-d and NVIDIA DynamoFri 16 Oct
• PostWhat’s new with Google CloudFri 16 Oct
• PostArchitecting autonomy: A design pattern for high-compute, governed agents in biotechFri 16 Oct
• PostAnnouncing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for KubernetesFri 16 Oct
• PostFour evaluation engineering lessons learned from building agent pluginsFri 16 Oct
• PostThe SAVE method: Learn the fundamentals to engineer trustworthy generative mediaFri 16 Oct

Certificate Manager — 1

• ChangeGoogle-managed public SSL certificates signed by Google Public CA (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity peri…Wed 14 Oct

Cloud Asset Inventory — 1

• FeatureThe following resource types are publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , Feed , and Search ( SearchAllR…Tue 13 Oct

Cloud Billing — 1

• FeatureSpend cap budgets are now generally available for a limited set of services For eligible services , you can configure a spend cap budget to automatically pause…Tue 13 Oct

Cloud Build — 1

• AnnouncementYou can now choose the release channel for your build config or private pool. The release channel determines how frequently the underlying versions of Debian an…Mon 12 Oct

Cloud DNS — 1

• FeatureOutbound Endpoints for Cloud DNS is available in Preview . Attach Outbound Endpoints to forwarding zones or server policies to enable direct DNS query forwardin…Mon 12 Oct

Cloud Load Balancing — 3

• FeatureRegular expression matchers in host and route rules in URL maps are now generally available (GA). You can now use regular expressions (regex) matchers to config…Mon 12 Oct
• ChangeGoogle-managed public SSL certificates signed by Public Certificate Authority ( pki.goog ) are gradually transitioning from a 90-day validity period to a 45-day…Wed 14 Oct
• FeatureService rate limiting policies are now available in Preview for regional internal Application Load Balancers and Secure Web Proxies. Service rate limiting polic…Wed 14 Oct

Cloud Run — 1

• FeatureSupport for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA) .Mon 12 Oct

Cloud SQL for MySQL — 2

• FeaturePrivate Service Connect is now the default private IP connectivity option when you create a Cloud SQL for MySQL instance in a new Google Cloud project. Private…Tue 13 Oct
• IssueWhen you enable the Knowledge Catalog (formerly Dataplex Universal Catalog) integration on a Cloud SQL for MySQL instance created before April 18, 2026, the int…Wed 14 Oct

Cloud SQL for PostgreSQL — 2

• FeaturePrivate Service Connect is now the default private IP connectivity option when you create a Cloud SQL for PostgreSQL instance in a new Google Cloud project. Pri…Tue 13 Oct
• IssueWhen you enable the Knowledge Catalog (formerly Dataplex Universal Catalog) integration on a Cloud SQL for PostgreSQL instance created before April 18, 2026, th…Wed 14 Oct

Cloud SQL for SQL Server — 1

• FeaturePrivate Service Connect is now the default private IP connectivity option when you create a Cloud SQL for SQL Server instance in a new Google Cloud project. Pri…Tue 13 Oct

Cloud Service Mesh — 7

• Announcement1.31.1-asm.16 is now available for in-cluster Cloud Service Mesh. You can now download 1.31.1-asm.16 for in-cluster Cloud Service Mesh. It includes the features…Mon 12 Oct
• Announcement1.30.5-asm.8 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Mon 12 Oct
• Announcement1.29.8-asm.8 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Mon 12 Oct
• Announcement1.28.10-asm.49 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service M…Mon 12 Oct
• FixedPatch 1.30.5-asm.8 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1)…Mon 12 Oct
• FixedPatch 1.29.8-asm.8 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1)…Mon 12 Oct
• FixedPatch 1.28.10-asm.49 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-18924 Yes Yes No Yes Medium (9.1…Mon 12 Oct

Cloud Storage — 3

• FeatureObject enrichments is now available in Preview . When you configure object enrichments, Cloud Storage applies Google's pre-trained machine learning models to el…Tue 13 Oct
• FeatureObject contexts with extended data are available in Preview . Google services attach these contexts to your objects during automated analysis, such as machine l…Tue 13 Oct
• FeatureStorage Insights datasets include the Object Contexts Catalog view ( object_contexts_catalog_view ), which you can use to analyze object contexts in BigQuery. F…Tue 13 Oct

Cloud Vision — 1

• DeprecatedFace detection model update The emotion label response in the Cloud Vision API is deprecated. Going forward, the Cloud Vision API face detection ( FACE_DETECTIO…Thu 15 Oct

Cluster Toolkit — 1

• FeatureCluster Toolkit v1.106.0 is available. This release adds support for flexible managed instance groups on static compute nodes , multiple network interfaces (mul…Tue 13 Oct

Compute Engine — 7

• FeatureGenerally available : The network-optimized C4N machine types with 375 GiB to 12,000 GiB of attached Titanium SSD are now generally available. For more informat…Mon 12 Oct
• FeatureGenerally available : You can query regional views of global Compute Engine project and OS image resources by using the regional read-only projectViews and imag…Tue 13 Oct
• FeatureGenerally available : When you reserve capacity by using future reservation requests, you can specify that Compute Engine delivers your reserved capacity as spe…Wed 14 Oct
• FeatureGenerally available : You can increase the size of a Google Cloud Hyperdisk volume that's in multi-writer mode while the volume is attached to multiple instance…Wed 14 Oct
• ChangeIf you try to create an on-demand reservation or increase the number of reserved Compute Engine instances in a reservation when the zone has reached its reserva…Thu 15 Oct
• FeaturePreview : You can create regional disks, including Hyperdisk Balanced High Availability volumes, by cloning a zonal boot disk. For more information, see Duplica…Thu 15 Oct
• FeatureGenerally available : The storage-optimized Z4M machine series is generally available for Compute Engine. Powered by fifth generation Intel Emerald Rapids Xeon…Thu 15 Oct

Config Connector — 5

• AnnouncementConfig Connector version 1.159.0 is now available.Tue 13 Oct
• FeatureNew Alpha Resources (Direct Reconciler): AIPlatformReasoningEngine Manage Gemini Enterprise Agent Platform reasoning engines to deploy and run customized reason…Tue 13 Oct
• FeatureNew Fields: ArtifactRegistryRepository Added support for spec.remoteRepositoryConfig.commonRepository . ComposerEnvironment Added support for updating spec.conf…Tue 13 Oct
• FeatureNew Features: Added support for Cloud SQL Enterprise Plus edition disaster recovery (DR) pair setup and drift suppression for SQLInstance by using the cnrm.clou…Tue 13 Oct
• FixedBug Fixes: BigQueryDataset ( #13352 ) Fixed false-positive diffs for access entries and avoided redundant PATCH requests when the resource is already up to date…Tue 13 Oct

Container Optimized OS — 15

• AnnouncementThis is an LTS Refresh release.Mon 12 Oct · cos-dev-138-20198-0-0
• AnnouncementThis is an LTS Refresh release.Mon 12 Oct · cos-121-18867-638-5
• AnnouncementThis is an LTS Refresh release.Mon 12 Oct · cos-125-19216-739-5
• Changecos-133-19999-44-126 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See ListMon 12 Oct · cos-133-19999-44-126
• Changecos-129-19506-549-7 Kernel Docker Containerd GPU Drivers COS-6.12.112 v27.5.1 v2.2.7 See ListMon 12 Oct · cos-129-19506-549-7
• Changecos-dev-138-20198-0-0 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See ListMon 12 Oct · cos-dev-138-20198-0-0
• ChangeFixed an issue where openssl 3.2 was being incorrectly installed. Openssl is now on version 3.5.7.Mon 12 Oct · cos-dev-138-20198-0-0
• ChangeUpdated default cos-gpu-installer version to v2.7.9. It installs ucodes firmwares for VR200.Mon 12 Oct · cos-dev-138-20198-0-0
• ChangeUpdated dev-libs/openssl to v3.5.9.Mon 12 Oct · cos-dev-138-20198-0-0
• ChangeUpdated the Linux kernel to v6.18.55.Mon 12 Oct · cos-dev-138-20198-0-0
• ChangeRuntime sysctl changes: Changed: kernel.threads-max: 63444 -> 63443 Changed: net.ipv4.udp_mem: 187941 250591 375882 -> 187941 250590 375882 Changed: user.max_cg…Mon 12 Oct · cos-dev-138-20198-0-0
• Changecos-121-18867-638-5 Kernel Docker Containerd GPU Drivers COS-6.6.158 v27.5.1 v2.0.10 See ListMon 12 Oct · cos-121-18867-638-5
• Changecos-125-19216-739-5 Kernel Docker Containerd GPU Drivers COS-6.12.112 v27.5.1 v2.2.7 See ListMon 12 Oct · cos-125-19216-739-5
• FeatureEnabled CONFIG_ARM_CCA_GUEST in the Linux kernel for ARM64 to support guest attestation on Arm CCA Confidential VMs.Mon 12 Oct · cos-dev-138-20198-0-0
• FeatureSecurity: Disable Magic SysRq for gmec-tdx-kernel-hostMon 12 Oct · cos-dev-138-20198-0-0

Dataflow — 1

• FeatureDataflow Auto VM Selection now supports 4th generation Compute Engine machine series. When Auto VM Selection is enabled, the service prioritizes these newer gen…Thu 15 Oct

Dataform — 2

• FeatureYou can use Developer Connect to connect Dataform repositories to Secure Source Manager repositories . This feature is in Preview .Tue 13 Oct
• FeatureYou can automatically preserve BigQuery data policies and data governance tags (Preview) applied to tables across Dataform executions by enabling the preserveGo…Wed 14 Oct

Dialogflow — 1

• Featuregemini-3.5-flash-lite has become generally available (GA). See Generative quotas for how to request quota for Gemini 3 and later models.Fri 16 Oct

Firestore with MongoDB compatibility — 1

• FeatureFirestore with MongoDB compatibility now supports QueryData, which you can use to build data agents that interact with the data in your database using conversat…Mon 12 Oct

Gemini Enterprise — 8

• FeatureGemini Enterprise: Gemini 4 Argon available in web app, mobile app, and AI developer tools Gemini 4 Argon is generally available (GA) for the Gemini Enterprise…Tue 13 Oct
• FeatureGemini Enterprise: Connect workflows in Workflow Builder to Microsoft Teams, Notion, and Salesforce You can connect workflows in Workflow Builder to Microsoft T…Tue 13 Oct
• FeatureGemini Enterprise: Gemini 4 Argon is available in AlphaEvolve AlphaEvolve experiments can generate candidate programs with Gemini 4 Argon in the global , us , a…Tue 13 Oct
• FeatureGemini Enterprise: Gemini 3.8 Flash regional availability in the United Kingdom Gemini 3.8 Flash is generally available (GA) in the United Kingdom. Location ava…Wed 14 Oct
• FeatureGemini Enterprise: Gemini 4 Argon available in Workflow Builder Gemini 4 Argon is generally available (GA) for Workflow Builder. Gemini 4 Argon is also availabl…Wed 14 Oct
• FeatureGemini Enterprise: Anthropic models are available in the Gemini Enterprise app Administrators can make Anthropic models—Claude Opus 5.5 and Claude Sonnet 5.5—av…Thu 15 Oct
• FeatureGemini Enterprise: Configure citations for custom MCP data stores You can configure the citation_mappings parameter for custom Model Context Protocol (MCP) data…Fri 16 Oct
• FeatureGemini Enterprise: Connect workflows in Workflow Builder to Confluence Data Center and Jira Data Center You can connect workflows in Workflow Builder to Conflue…Fri 16 Oct

Gemini Enterprise Agent Platform — 6

• FixedCodeMender updates (v0.14.0) This release introduces updates to CodeMender: Better pull request scans : cm find --diff now catches removed security controls and…Mon 12 Oct
• FeatureGemini 4 Argon in CodeMender (Preview) CodeMender now supports Gemini 4 Argon. To use it, pass --model gemini-4-argon to cm find , cm verify , or cm fix . Gemin…Tue 13 Oct
• FeatureGemini 4 Argon and Gemini 4 Argon Cyber Permissive Gemini 4 Argon ( gemini-4-argon ) is available in General Availability (GA) . Gemini 4 Argon is Google's fron…Tue 13 Oct
• FeaturePriority PayGo support for Gemini Nano Banana 2.1 Priority Pay-as-you-go (PayGo) is available in General Availability (GA) for Gemini Nano Banana 2.1 ( gemini-n…Wed 14 Oct
• FeatureDeepSeek-V4.1-Flash is available in Public Preview DeepSeek-V4.1-Flash from DeepSeek is available as a fully managed model (MaaS) in Model Garden. The model acc…Wed 14 Oct
• FixedCodeMender updates (v0.15.0) This release introduces updates to CodeMender: Enhanced SARIF 2.1.0 reporting : Updated cm report SARIF output with standardized ru…Wed 14 Oct

Google Cloud Armor — 1

• FeatureCloud Armor supports service rate limiting. For more information, see Cloud Armor and service rate limiting . This feature is available in Preview.Wed 14 Oct

Google Cloud Contact Center as a Service — 6

• AnnouncementGoogle Cloud CCaaS prerelease notes 6.22 Here are the pre-release notes for what we expect to be the next version of Google Cloud CCaaS. When we release this ve…Tue 13 Oct
• FeatureCampaign-based scheduled callbacks Agents can now schedule a callback during an outbound campaign call. The callback belongs to the campaign, not to an individu…Tue 13 Oct
• FeatureTranscript separation for chat You can now configure Google Cloud CCaaS to deliver a separate transcript file for each participant segment in a chat, instead of…Tue 13 Oct
• FixedThis release addresses the following issues: Fixed an issue where direct access point (DAP) greeting messages played twice when a call was deflected to an inter…Tue 13 Oct
• AnnouncementAdvanced reporting dashboards prerelease notes 6.16 Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI…Fri 16 Oct
• FixedThis release addresses the following issues: Fixed an issue where the Agent Performance tile on the Real-time Agent Monitoring dashboard executed redundant data…Fri 16 Oct

Google Cloud Managed Service for Apache Kafka — 2

• AnnouncementThe Service Level Agreement (SLA) for Managed Service for Apache Kafka now covers the Produce API. For more information, see Managed Service for Apache Kafka Se…Mon 12 Oct
• FeaturePerformance of the Cloud Storage Sink connector has been improved. The improvements include reduced out-of-memory errors, higher maximum throughput, and avoidin…Wed 14 Oct

Google Distributed Cloud (software only) for VMware — 3

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.35.600-gke.140 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Mon 12 Oct
• FixedThe following issues were fixed in 1.35.600-gke.140: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where audit-proxy retried audit log ex…Mon 12 Oct
• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.35.600-gke.141 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Tue 13 Oct

Google Distributed Cloud (software only) for bare metal — 3

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.35.600-gke.140 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cl…Mon 12 Oct
• FixedThe following issues were fixed in 1.35.600-gke.140: Fixed vulnerabilities listed in Vulnerability fixes . Improved containerd resilience against state corrupti…Mon 12 Oct
• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.35.600-gke.141 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cl…Tue 13 Oct

Google Kubernetes Engine — 14

• Change(2026-R44) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Wed 14 Oct
• Change(2026-R44) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 14 Oct
• Change(2026-R44) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 14 Oct
• Change(2026-R44) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 14 Oct
• Change(2026-R44) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 14 Oct
• Change(2026-R44) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 14 Oct
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 14 Oct
• FixedFixed an issue in GKE Sandbox where Pods using the Cloud Storage FUSE CSI driver could become indefinitely stuck in a Terminating state. To resolve this issue,…Wed 14 Oct
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 14 Oct
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 14 Oct
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 14 Oct
• Security(2026-R44) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Wed 14 Oct
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 14 Oct
• ChangeFor GKE Standard CPU node pools, GKE can now upgrade nodes by updating the existing Compute Engine VM in place, instead of deleting the VM and creating a new on…Fri 16 Oct

Google SecOps — 2

• ChangeGoogle SecOps has updated the list of supported default parsers . Parsers are updated gradually, so it might take one to four days before you see the changes re…Mon 12 Oct
• Feature[Spotlight Feature] Monitor response and playbook health with the Response Health Hub Google SecOps now includes the Response Health Hub curated dashboard, a ce…Mon 12 Oct

Looker — 2

• FeatureLooker (Google Cloud core) now supports Workforce Identity Federation in preview for instances that use Looker 26.18 and later. Workforce Identity Federation al…Mon 12 Oct
• FeatureThe Looker 26.18 features have begun to be enabled for Looker (Google Cloud core) instances.Thu 15 Oct

Managed Service for Apache Airflow — 15

• AnnouncementA new Managed Service for Apache Airflow release has started on October 13, 2026 . Get ready for upcoming changes and features as we roll out the new release to…Tue 13 Oct
• ChangeThe apache-airflow-providers-google package was upgraded to version 22.6.0. For more information about changes, see the apache-airflow-providers-google changelo…Tue 13 Oct
• ChangeThe apache-airflow-providers-cncf-kubernetes package was upgraded to version 10.23.0 . For changes in other packages, see the preinstalled packages changelog .Tue 13 Oct
• ChangeNew images are available in Managed Airflow (Gen 2): composer-2.17.15-airflow-2.11.1 (default)Tue 13 Oct
• ChangeNew Airflow builds are available in Managed Airflow (Gen 3): composer-3-airflow-3.3.1-build.4 composer-3-airflow-3.2.2-build.8 composer-3-airflow-2.11.1-build.2…Tue 13 Oct
• DeprecatedThe following Managed Airflow versions and builds have reached their end of support period : composer-3-airflow-2.9.3-build.35, composer-3-airflow-2.10.5-build.…Tue 13 Oct
• FeatureDevelopment mode environments and Environment hibernation are now generally available (GA). You can now create Managed Airflow (Gen 3) environments with Airflow…Tue 13 Oct
• FeatureUpgrade rollbacks are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or com…Tue 13 Oct
• FeatureNew Managed Airflow (Gen 3) environments created while the Restrict Endpoint Usage ( constraints/gcp.restrictEndpointUsage ) organization policy is active now u…Tue 13 Oct
• Feature(Managed Airflow Gen 3) Added the scheduler loop duration metric: composer.googleapis.com/workload/scheduler/loop_duration : time spent running one Scheduler lo…Tue 13 Oct
• FeatureDatabase retention in Managed Airflow (Gen 3) now includes new Airflow 3 metadata tables, and updated retention logs to report the exact number of removed rows.…Tue 13 Oct
• FixedManaged Airflow (Gen 3) environments now report Airflow workloads startup failure logs for issues such as internal quota limits, insufficient capacity, or inter…Tue 13 Oct
• FixedFixed an issue where a redundant image-version property set in the API request body could sometimes cause a long-running operation to fail.Tue 13 Oct
• Fixed(Managed Airflow Gen 2) Fixed an issue where the airflow-monitoring pod could run out of memory ( OOMKilled ) when calculating scheduled snapshot metrics in env…Tue 13 Oct
• AnnouncementAll Managed Airflow environment's GKE clusters will be set up with maintenance exclusions from November 16, 2026 to December 2, 2026. For more information, see…Wed 14 Oct

Managed Service for Apache Spark — 2

• AnnouncementNew Managed Service for Apache Spark (formerly Dataproc on Compute Engine) subminor cluster image versions : 2.1.120-debian11, 2.1.120-rocky8, 2.1.120-ubuntu20,…Mon 12 Oct
• FixedManaged Service for Apache Spark (formerly Dataproc on Compute Engine): A bug has been fixed to add-back py4j library in image version 2.1.120.Mon 12 Oct

NetApp Volumes — 2

• FeatureGoogle Cloud NetApp Volumes now lets you test Active Directory policy connections for the Flex Unified service level in Preview . You can use the Google Cloud c…Wed 14 Oct
• AnnouncementGoogle Cloud NetApp Volumes now supports the Flex Unified service level, including custom performance, in the following region: europe-west8 (Milan) For more in…Thu 15 Oct

Network Connectivity Center — 1

• FixedThe technical issue causing incorrect billing for producer VPC spokes has been fixed. Starting today, projects with producer VPC spokes linked to Network Connec…Mon 12 Oct

Secure Web Proxy — 1

• FeatureSecure Web Proxy supports service rate limiting policies . Use these policies to protect external destinations from traffic overloads and manage the costs of yo…Wed 14 Oct

Security Command Center — 1

• FeatureTo increase the precision of attack path analysis and provide attack exposure scores that help you prioritize confirmed internet exposures, Risk Engine attack p…Thu 15 Oct

Security bulletin — 2

• GCP-2026-067Published: 2026-10-12 Description Description Severity Notes A Denial-of-Service (DoS) vulnerability was discovered in Envoy Proxy when an HTTP filter (such as…Mon 12 Oct
• GCP-2026-068Published: 2026-10-14 Description Description Severity Notes An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution run…Wed 14 Oct

VPC Service Controls — 1

• FeatureVPC Service Controls feature (Status: Preview ) : Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resource…Wed 14 Oct

Vertex AI Search — 1

• ChangeAgent Search: Update to the stable model The stable model for answer generation is updated to gemini-3.5-flash/answer_gen/v1 from gemini-2.5-flash/answer_gen/v1…Fri 16 Oct

Video Intelligence API — 1

• DeprecatedWe are deprecating the emotion label response in the API. Going forward, the API will return UNKNOWN for all emotion related labels.Thu 15 Oct

Official Google Cloud references

• Google Cloud release notes
• Google Cloud security bulletins
• Google Cloud blog
• Cloud Service Mesh security bulletins
• VPC Service Controls
• Cloud DNS Outbound Endpoints