Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

218 notes across 43 products and five days, down from 236 — and this is a security week rather than a feature week. Three security bulletins landed, every one of them asking something of you, which is notable in itself: last week produced a Critical that required no customer action at all. The headline is a certificate authority whose subordinate CA private keys were generated with insufficient entropy and can be reconstructed, affecting around twenty Google Cloud and Firebase products and every operating system image you maintain yourself. It is rated Medium. Alongside it, a Critical pair of PHP remote code execution flaws, an Istio and Envoy advisory, and a quietly significant GKE fleet-management fix. On the networking side, the item most useful to this series is small: VPC Flow Logs went GA with Cloud NAT drop reasons, which makes port exhaustion a thing you can see rather than infer.

A certificate authority lost its keys

GCP-2026-071, published 23 October, is the week. On Saturday, October 17, 2026, Google received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates, including those cross-signed by AAA Certificate Services. The response was immediate and final: consequently, these CA certificates are no longer trusted and are being revoked.

The mechanism is worth stating because it explains why this is not a routine revocation. The private keys for eight eMudhra (emSign) subordinate Certification Authority (CA) certificates were generated using insufficient cryptographic randomness (weak entropy). The keys were not stolen; they were derivable. And the consequence follows directly: this weakness allows a remote attacker with network access to reconstruct private keys, forge trusted TLS certificates, and perform Man-in-the-Middle (MitM) interception against TLS clients, containers, or SDKs that have not yet removed trust in these subordinate CAs.

Google's own position is clear and worth repeating accurately rather than paraphrasing: although Google Cloud infrastructure remains uncompromised, the following Google Cloud and Firebase products, base images, and client SDKs are impacted — a list running to roughly twenty entries including Compute Engine, GKE, Cloud Run, Cloud SQL, AlloyDB, Confidential Space and the gcloud CLI. And on exploitation: security telemetry shows no evidence of exploitation against Google Cloud workloads, and proactive mitigations are in place across Google-managed environments to block and distrust the affected certificate authority certificates.

It carries CVE-2026-111943 and is rated Medium. That rating is defensible — no evidence of exploitation, mitigations already deployed across Google-managed fleets — and it is also the clearest example I have seen of why severity is the wrong field to triage on. A Medium here means a trust-store update on every self-managed image in the estate, plus a node restart cycle for COS, plus a CLI upgrade. Last week's Critical meant reading one sentence and doing nothing.

Two more bulletins, and the severity lesson repeated

GCP-2026-070, published 21 October and rated Critical: two remote code execution vulnerabilities were found in the open-source PHP language. The scoping sentence is the one to read carefully — while Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable — and the affected range is enormous: all PHP versions between 5.4 and 8.5. Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the instruction is unambiguous: customers should take immediate action to protect their workloads by redeploying their workloads with updated dependencies.

Two mitigations soften it. Some platforms self-heal — some workloads may be automatically patched and updated to the latest PHP if they are on Google App Engine Standard or one of Cloud Run, Cloud Run functions with automatic updates enabled — and there is a way to find your exposure rather than guess at it: customers using Artifact Analysis receive notifications of these vulnerabilities on both new and existing artifacts to help them identify at-risk workloads. It carries CVE-2026-109618 and a second CVE alongside it.

GCP-2026-069, published 19 October and rated Moderate to High: security vulnerabilities were discovered in Istio and Envoy Proxy ( ISTIO-SECURITY-2026-007 ), with four GHSA identifiers and a pointer rather than instructions — for instructions and more details, see the Cloud Service Mesh security bulletin. Anyone running Cloud Service Mesh has to follow that link; the bulletin itself does not carry the remediation. Worth noting this is the third consecutive week with an Envoy-related advisory, after the DoS in GCP-2026-067.

So three bulletins, three severity bands, and all three require customer work — against last week's single Critical that required none. Two weeks is not a trend, but it is now twice that the rating has told me nothing about whether to open a terminal.

NAT port exhaustion becomes visible

The smallest item in the window is the one that changes something for this series. General Availability: VPC Flow Logs adds the following metadata annotations and packet drop reasons for Cloud NAT — the annotations being metadata annotations: connection.nat_ip , connection.nat_port , and nat_gateway_details, and the drop reasons drop reasons: NAT_ENDPOINT_INDEPENDENT_CONFLICT , NAT_OUT_OF_CONNECTIONS , and NAT_OUT_OF_PORTS.

Those three drop reasons are the answer to a question this block of the architecture series kept running into. #69 established that Google Cloud has two different drop behaviours and that telling them apart is most of the diagnosis: an empty route model returns an ICMP unreachable, while a subnet route matching an address with nothing live behind it drops in silence. NAT exhaustion has always been in the second category — a connection that simply does not happen, with nothing in the path to say why. Naming NAT_OUT_OF_PORTS and NAT_OUT_OF_CONNECTIONS as flow-log drop reasons converts that from an inference about capacity into a record you can query, and connection.nat_ip with connection.nat_port makes the translation itself visible rather than opaque.

Cloud Armor shipped two security notes the same day, both WAF ruleset maintenance: fixes and enhancements to the preconfigured WAF v33-stable rulesets and separately to the stable rulesets for v3.0. Routine, and the kind of thing worth knowing happens continuously if you have tuned rules against a specific ruleset version.

Platform, data and the rest

A GKE fix worth noticing for what it was. A security issue in GKE fleet management that could have allowed unauthorized configuration changes to clusters registered to a fleet has been resolved, and the fixes are rolled out to all regions, and no action is required. Unauthorized configuration changes to fleet-registered clusters is a serious class of problem, disclosed as a one-line Fixed note rather than a bulletin. No action needed, but worth logging that it happened.

The week's only Breaking tag. Gemini 2.5 Pro has been discontinued for in-country Gemini Enterprise app deployments in Canada and Japan, and the fallback is automatic: agents and chat sessions in these regions that previously used Gemini 2.5 Pro automatically switch to in-country Gemini 3.5 Flash. The scope is narrow — Gemini 2.5 Pro remains available in the global , us , and eu regions — so this is a data-residency consequence rather than a general withdrawal. An automatic switch to a different model class is the sort of change that does not break a deployment and does change its behaviour.

A dated billing change with four days of notice. On October 26, 2026, Gemini 4 Argon will replace Gemini 3.8 Flash as the default model for new AlphaEvolve experiments, published 22 October. The money sentence is explicit: from that date, new experiments that use the default model are billed at Gemini 4 Argon token prices instead of Gemini 3.8 Flash token prices. Opting out is a one-line change — to keep using Gemini 3.8 Flash, specify gemini-3.8-flash in the models field — and existing work is safe, since experiments created before October 26, 2026 keep the model recorded in their configuration. Anything that relies on the default and has a budget attached needs looking at before Monday.

Data. Spanner supports approximate aggregate functions for both GoogleSQL and PostgreSQL dialects, which produce statistical estimates of distinct counts, allowing you to compute results faster and save resources on large datasets compared to exact aggregation — HyperLogLog++ and sketches, for the cases where an exact distinct count is not worth what it costs.

Volume, for context. Looker and Container-Optimized OS each contributed sixteen notes, Contact Center as a Service ten, and Apigee X and Cloud Service Mesh seven apiece. The COS run is the usual milestone-release pattern the inventory rolls up rather than deduplicates, and this week it is carrying the CA mitigation described above.

What I would act on

1. Update the trust store on every image you build yourself. GCP-2026-071 is the week's real work: RHEL via RHSB-2026-012, Ubuntu via USN-8944-1, Debian via the latest ca-certificates, Windows via current updates, and COS by upgrading or restarting nodes or applying cos_ca_cert_mitigation. Managed services are Google's problem; your base images are not.
2. Upgrade the gcloud CLI, including on build agents. The same bulletin asks for it explicitly, and CI runners are the copies nobody remembers to update.
3. Find your PHP exposure with Artifact Analysis rather than by asking teams. Everything between 5.4 and 8.5 is affected, the fix versions are named, and App Engine Standard and Cloud Run with automatic updates may already have handled it — so the useful first step is an inventory, not a redeploy.
4. If you run Cloud Service Mesh, open the CSM bulletin today. GCP-2026-069 deliberately does not carry the remediation, and this is the third week running with an Envoy advisory.
5. Check AlphaEvolve experiments that rely on the default model before 26 October. Four days of notice, and the consequence is a different token price rather than an error.
6. Turn on the new Cloud NAT drop reasons if you run Cloud NAT at any scale. NAT_OUT_OF_PORTS in a log is worth a great deal more than a theory about port allocation.

Complete inventory — all 218 notes

How this inventory reconciles

Google Cloud published 218 notes across 43 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (48 notes) — Security48 notes, across 7 releases (cos-121-18867-638-13, cos-121-18867-652-7, cos-125-19216-739-16, cos-125-19216-760-8, cos-129-19506-549-22, cos-129-19506-578-9, cos-133-19999-44-159). They fix 14 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-111943, CVE-2026-19445, CVE-2026-33186, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-42508, CVE-2026-46595, CVE-2026-5435, CVE-2026-6100, CVE-2026-80256, CVE-2026-82474, CVE-2026-99999.
• Container Optimized OS (22 notes) — Fixed22 notes, across 7 releases (cos-121-18867-638-13, cos-121-18867-652-7, cos-125-19216-739-16, cos-125-19216-760-8, cos-129-19506-549-22, cos-129-19506-578-9, cos-133-19999-44-159). 8 distinct texts, each repeated once per release and counted individually:
  • Added support for loading the pci-pf-stub module.
  • Added support for net-fs/lustre-client-drivers v2.14.0_p262-r1.
  • Fix docker cp failure when copying to/from containers with nested bind mounts.
  • Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020.
  • Upgraded app-editors/vim to v9.2.1125, Upgraded app-editors/vim-core to v9.2.1125.
  • Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152.
  • Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise.
  • Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise.

One change, published under several products

• SecurityAll supported versions of PHP 8.2 and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See Respondin…Published under 4 products: App Engine flexible environment PHP, App Engine standard environment PHP, Cloud Run, Cloud Run functions.
• SecurityIn response to GCP-2026-071 , Google is updating Cloud SQL's managed components. No manual updates to the certificate store are required for Cloud SQL-managed i…Published under 3 products: Cloud SQL for MySQL, Cloud SQL for PostgreSQL, Cloud SQL for SQL Server.
• SecurityThis note is incorrect; follow guidance in the entry for October 22, 2026 . Patch updates to supported PHP runtimes are available with deployments from source:…Published under 3 products: App Engine flexible environment PHP, App Engine standard environment PHP, Cloud Run functions.
• FeatureText search and Geospatial search are generally available ( GA ).Published under 2 products: Firestore, Firestore with MongoDB compatibility.

Everything else, by product

Agent Platform Workbench — 6

• Change20261018.00_p0 ReleaseMon 19 Oct · 20261018.00_p0
• ChangeInstalled latest packages from upstream dependencies.Mon 19 Oct · 20261018.00_p0
• Change20261018.00_p0 ReleaseMon 19 Oct · 20261018.00_p0
• ChangeInstalled latest packages from upstream dependencies.Mon 19 Oct · 20261018.00_p0
• FixedFixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable se…Mon 19 Oct · 20261018.00_p0
• FixedFixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable se…Mon 19 Oct · 20261018.00_p0

AlloyDB for PostgreSQL — 1

• FeatureLakehouse federation in AlloyDB is generally available ( GA ). This feature lets you query live data in BigQuery directly from AlloyDB using the bigquery_fdw ex…Mon 19 Oct

Apigee X — 7

• AnnouncementOn October 20th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows . If you set a preferred window for maintenance for y…Tue 20 Oct
• AnnouncementApigee Emulator Apigee Emulator v2.0.2 On October 21, 2026, we released Apigee Emulator version 2.0.2. This release upgrades the Apigee Emulator runtime to Java…Wed 21 Oct · Apigee
• FeatureApigee Emulator Changed in this release Upgraded the Apigee Emulator runtime JVM to Eclipse Temurin JRE 21 ( 21.0.12.1.0+1-0 , from JRE 11 11.0.31+11 ), adding…Wed 21 Oct · Apigee
• SecurityApigee Emulator Security This release addresses 46 security vulnerabilities across Netty, the embedded Go standard library, Jackson, Apache Log4j, Eclipse Jetty…Wed 21 Oct · Apigee
• AnnouncementOn October 22, 2026, we released an updated version of Apigee (1-18-0-apigee-7). Note: Rollouts of this release began today and can take four or more business d…Thu 22 Oct
• FixedBug ID Description 568535165 Skip main_task_wait_time and nio_task_wait_time metrics for the first 12 Prometheus scrapes during Message Processor startup warmup…Thu 22 Oct
• SecurityBug ID Description 573663408 Security fix for Apigee. Upgraded the ingress gateway to patch security vulnerabilities. N/A Security fix for Apigee infrastructure…Thu 22 Oct

Apigee hybrid — 3

• Announcementv1.15.9 On October 21, 2026 we released an updated version of the Apigee hybrid software, v1.15.9. For information on upgrading, see Upgrading Apigee hybrid to…Wed 21 Oct · v1.15.9
• FixedFixed in this release Bug ID Description 573622417 Fixed an issue where apigee-ingressgateway forwarded the x-envoy-decorator-operation header to upstream runti…Wed 21 Oct · v1.15.9
• SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-56857 CVE-2026-56866 CVE-2026-78659 CVE-20…Wed 21 Oct · v1.15.9

BigQuery — 2

• FeatureThe AI.CHUNK_DOCUMENT function is a table-valued function that splits unstructured documents into semantically coherent text chunks optimized for vector embeddi…Wed 21 Oct
• FeatureThe AI.TRANSLATE function lets you translate text strings between languages. AI.TRANSLATE supports standard Neural Machine Translation (NMT) workloads and Trans…Thu 22 Oct

Blog — 20

• PostBuilding full virtual vehicles on Google Cloud: From AAOS to the smallest MCUMon 19 Oct
• PostHow to Use Python UDF Logging for Pipeline ObservabilityMon 19 Oct
• PostManaged RAG search inside the sovereign perimeter: Gemini on GDC enterprise searchTue 20 Oct
• PostClaude Opus 5.5 and Claude Sonnet 5.5 are now available in Google AntigravityTue 20 Oct
• PostTorchTPU is now open source: Run native PyTorch on TPUsTue 20 Oct
• PostAnnouncing llm-d 1.0: Open distributed inference for agents on Google Cloud TPUs and GPUsTue 20 Oct
• PostAnnouncements and highlights from Google Public Sector Summit 2026Tue 20 Oct
• PostEnabling the next era of sovereign AI: The latest Google Distributed Cloud innovationsTue 20 Oct
• PostIntroducing Gemini for government servicesTue 20 Oct
• PostBigQuery ObjectRef now GA: Build multimodal data platforms for conversational analytics entirely in SQLWed 21 Oct
• PostZenteiQ scales batch inference 4x with GKE Inference Gateway powered by llm-dWed 21 Oct
• PostResponding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619Wed 21 Oct
• PostGoogle Public Sector increases partner investments for frontline adoptionWed 21 Oct
• PostGoogle Cloud expands model choice and flexibility, bringing OpenAI models to customersWed 21 Oct
• PostHardware-backed security at global scale: Confidential G4 with NVIDIA Blackwell is GAWed 21 Oct
• PostGoogle Cloud and NVIDIA expand co-engineering collaboration to scale infrastructure for the agentic eraWed 21 Oct
• PostExpanding Claude availability and deployment choice on Google CloudThu 22 Oct
• PostIntroducing new self-learning context enrichment in Knowledge CatalogThu 22 Oct
• PostInside Agent Compute Engine: Building the compute foundation for the agentic eraThu 22 Oct
• PostIntroducing Agent Compute Engine and expanded agent governanceThu 22 Oct

Buildpacks — 1

• FeaturePatch updates to PHP runtimes are available on google-22 and google-24 tags: 8.5.12 , 8.4.27 , 8.3.36 , and 8.2.35 . Take immediate action to protect your PHP w…Wed 21 Oct

Cloud Asset Inventory — 1

• FeatureThe following resource types are publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , Feed , and Search ( SearchAllR…Mon 19 Oct

Cloud Billing — 1

• FeatureSKU attributes and granular usage units in pricing data export (Preview) SKU attributes and granular usage units are now available in Preview in the Cloud Billi…Wed 21 Oct

Cloud Monitoring — 1

• FixedOps Agent version 2.73.0 includes patches for a Go vulnerability involving system root certificates, CVE-2026-111943 . For more information, see Ops Agent 2.73.…Fri 23 Oct

Cloud Run — 2

• SecurityThis note is incorrect; follow guidance in the entry for October 22, 2026 . Patch updates to supported PHP runtimes are available for Cloud Run resources deploy…Wed 21 Oct
• FeatureYou can configure Direct VPC ingress for Cloud Run instances ( Preview ). Direct VPC ingress lets Cloud Run instances on a VPC network use their own ephemeral p…Thu 22 Oct

Cloud Service Mesh — 7

• AnnouncementIn-cluster Cloud Service Mesh 1.28 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported ver…Mon 19 Oct
• Announcement1.31.1-asm.19 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Me…Mon 19 Oct
• Announcement1.30.5-asm.11 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Me…Mon 19 Oct
• Announcement1.29.8-asm.11 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Me…Mon 19 Oct
• Announcement1.28.10-asm.52 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service M…Mon 19 Oct
• FixedPatch 1.31.1-asm.19 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity GHSA-gcjh-h69q-9w9g No Yes Yes No Medium (…Mon 19 Oct
• SecurityThe following images are now rolling out for managed Cloud Service Mesh: Sidecar version 1.21.6-asm.93 is rolling out to the rapid release channel. Sidecar vers…Mon 19 Oct · Rapid

Cloud Tasks — 1

• ChangeCloud Tasks is available in the following locations : asia-south2 (Delhi, India) northamerica-northeast2 (Toronto, Canada)Mon 19 Oct

Cloud Workstations — 1

• FeatureCloud Workstations supports automatic failover for boost configurations in Preview . When you enable automatic failover, Cloud Workstations automatically provis…Tue 20 Oct

Compute Engine — 3

• FeatureGenerally available : To prevent data loss or corruption when you stop or delete a Compute Engine instance, you can enable graceful shutdown. This setting gives…Mon 19 Oct
• FeatureYou can view how a managed instance group (MIG) distributes its instances across zones and machine types, directly from the MIG's Monitoring tab in the Google C…Thu 22 Oct
• FeatureGenerally available : Resource-based committed use discounts (CUDs) are available for block storage resources like Google Cloud Hyperdisk Balanced and Google Cl…Thu 22 Oct

Confidential Space — 1

• AnnouncementA new Confidential Space image (261000) is available.Mon 19 Oct

Container Optimized OS — 16

• Changecos-129-19506-549-22 Kernel Docker Containerd GPU Drivers COS-6.12.112 v27.5.1 v2.2.7 See ListMon 19 Oct · cos-129-19506-549-22
• Changecos-125-19216-739-16 Kernel Docker Containerd GPU Drivers COS-6.12.112 v27.5.1 v2.2.7 See ListMon 19 Oct · cos-125-19216-739-16
• ChangeRuntime sysctl changes: Changed: fs.epoll.max_user_watches: 1808517 -> 1808562 Changed: fs.fanotify.max_user_marks: 68412 -> 68416 Changed: fs.inotify.max_user_…Mon 19 Oct · cos-125-19216-739-16
• Changecos-121-18867-638-13 Kernel Docker Containerd GPU Drivers COS-6.6.158 v27.5.1 v2.0.10 See ListMon 19 Oct · cos-121-18867-638-13
• ChangeRuntime sysctl changes: Changed: fs.epoll.max_user_watches: 1809007 -> 1809051 Changed: kernel.threads-max: 63199 -> 63204 Changed: net.ipv4.tcp_mem: 94041 1253…Mon 19 Oct · cos-121-18867-638-13
• AnnouncementThis is an LTS Refresh release.Thu 22 Oct · cos-125-19216-760-8
• AnnouncementThis is an LTS Refresh release.Thu 22 Oct · cos-121-18867-652-7
• AnnouncementThis is an LTS Refresh release.Thu 22 Oct · cos-129-19506-578-9
• Changecos-133-19999-44-159 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See ListThu 22 Oct · cos-133-19999-44-159
• ChangeRuntime sysctl changes: Changed: fs.epoll.max_user_watches: 1807627 -> 1807671 Changed: fs.fanotify.max_user_marks: 68378 -> 68382 Changed: fs.inotify.max_user_…Thu 22 Oct · cos-133-19999-44-159
• Changecos-125-19216-760-8 Kernel Docker Containerd GPU Drivers COS-6.12.113 v27.5.1 v2.2.7 See ListThu 22 Oct · cos-125-19216-760-8
• Changecos-121-18867-652-7 Kernel Docker Containerd GPU Drivers COS-6.6.159 v27.5.1 v2.0.10 See ListThu 22 Oct · cos-121-18867-652-7
• Changecos-129-19506-578-9 Kernel Docker Containerd GPU Drivers COS-6.12.113 v27.5.1 v2.2.7 See ListThu 22 Oct · cos-129-19506-578-9
• ChangeRuntime sysctl changes: Changed: fs.epoll.max_user_watches: 1808517 -> 1808562 Changed: fs.fanotify.max_user_marks: 68412 -> 68416 Changed: fs.inotify.max_user_…Thu 22 Oct · cos-129-19506-578-9
• FeatureAdded KVM virtualization support for AMD CPUID faulting.Thu 22 Oct · cos-133-19999-44-159
• FeatureAdded nvidia-container-toolkit to ARM images.Thu 22 Oct · cos-133-19999-44-159

Data Studio — 1

• FeatureYou can connect Data Studio to a BigQuery Graph or query a graph by using a custom SQL query in the BigQuery connector, which imports graph measures as metrics…Thu 22 Oct

Dataflow — 1

• FeatureDataflow now supports streaming high availability for Streaming Engine jobs ( Preview ). When you enable the requires_high_availability service option, Dataflow…Wed 21 Oct

Dialogflow — 1

• FeatureDialogflow CX : You can set the telephony_disable_voice_processing session parameter to true to turn off speech recognition and accept only DTMF input for the r…Mon 19 Oct

Firestore — 1

• FeatureData modification language (DML) operations are generally available ( GA ). Added support for insert and upsert .Thu 22 Oct

GKE security bulletin — 1

• GCP-2026-071Published: 2026-10-23 Reference: CVE-2026-111943 Description Severity Multiple eMudhra ( emSign ) subordinate Certificate Authority (CA) private keys were compr…Fri 23 Oct

Gemini Enterprise — 4

• BreakingGemini Enterprise: Gemini 2.5 Pro discontinued in Canada and Japan Gemini 2.5 Pro has been discontinued for in-country Gemini Enterprise app deployments in Cana…Tue 20 Oct
• FeatureGemini Enterprise: Antigravity Enterprise Gateway support Antigravity Enterprise Gateway lets organizations route model inference requests from the Antigravity…Tue 20 Oct
• AnnouncementGemini Enterprise: Gemini 4 Argon becomes the default model for AlphaEvolve on October 26, 2026 On October 26, 2026, Gemini 4 Argon will replace Gemini 3.8 Flas…Thu 22 Oct
• FeatureGemini Enterprise: Single-user quota limits Gemini Enterprise administrators can configure single-user quota limits on the Usage & Spending > Usage page in the…Thu 22 Oct

Gemini Enterprise Agent Platform — 1

• FixedCodeMender updates (v0.16.0) This release introduces updates to CodeMender: Deep scan by default ( cm find ) : cm find now runs a concurrent file-by-file deep s…Wed 21 Oct

Google Cloud Armor — 2

• SecuritySecurity fixes and enhancements to Cloud Armor preconfigured WAF v33-stable rulesets. For more information, see Tuning Google Cloud Armor WAF rules . The follow…Mon 19 Oct
• SecuritySecurity fixes and enhancements to Cloud Armor preconfigured WAF stable rulesets for v3.0. For more information, see Tuning Google Cloud Armor WAF rules . The f…Mon 19 Oct

Google Cloud Contact Center as a Service — 10

• AnnouncementGoogle Cloud CCaaS 6.22 We've released version 6.22 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you…Mon 19 Oct
• FeatureTranscript separation for chat You can now configure Google Cloud CCaaS to deliver a separate transcript file for each participant segment in a chat, instead of…Mon 19 Oct
• FeatureCampaign-based scheduled callbacks Agents can now schedule a callback during an outbound campaign call. The callback belongs to the campaign, not to an individu…Mon 19 Oct
• FixedThis release addresses the following issues: Fixed an issue where direct access point (DAP) greeting messages played twice when a call was deflected to an inter…Mon 19 Oct
• AnnouncementAdvanced reporting dashboards prerelease notes 6.24 Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI…Thu 22 Oct
• FixedThis release addresses the following issues: Fixed an issue where call and chat type names were cut off in the Dashboard Reports selector on wide-screen display…Thu 22 Oct
• AnnouncementGoogle Cloud CCaaS prerelease notes 6.26 Here are the prerelease notes for the next version of Google Cloud CCaaS. When we release this version, we expect the n…Fri 23 Oct
• FeatureScheduled callback for IVR overcapacity Scheduled callback is now available as an overcapacity deflection option for IVR queues. When a queue is over capacity,…Fri 23 Oct
• FeatureSalesforce: PKCE and refresh token rotation support You can now connect Google Cloud CCaaS to Salesforce apps that require Proof Key for Code Exchange (PKCE) an…Fri 23 Oct
• FixedThis release addresses the following issues: Fixed an issue where the Branded caller ID label was truncated in the Outbound Number selector when the agent appli…Fri 23 Oct

Google Distributed Cloud (software only) for VMware — 4

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.36.200-gke.118 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Wed 21 Oct
• FixedThe following issues were fixed in 1.36.200-gke.118: Fixed vulnerabilities listed in Vulnerability fixes .Wed 21 Oct
• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.34.1000-gke.111 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Thu 22 Oct
• FixedThe following issues were fixed in 1.34.1000-gke.111: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where updating or upgrading a cluster…Thu 22 Oct

Google Distributed Cloud (software only) for bare metal — 6

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.36.200-gke.118 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cl…Wed 21 Oct
• FeatureThe following changes were added in 1.36.200-gke.118: Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration…Wed 21 Oct
• FixedThe following issues were fixed in 1.36.200-gke.118: Fixed vulnerabilities listed in Vulnerability fixes . Fixed BareMetalMachine conditions during maintenance…Wed 21 Oct
• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.34.1000-gke.111 is now available for download. To upgrade, see Upgrade clusters . Google Distributed C…Thu 22 Oct
• FeatureThe following features were introduced in 1.34.1000-gke.111: Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configu…Thu 22 Oct
• FixedThe following issues were fixed in 1.34.1000-gke.111: Fixed vulnerabilities listed in Vulnerability fixes . Fixed BareMetalMachine conditions during maintenance…Thu 22 Oct

Google Kubernetes Engine — 3

• FeatureYou can now provision GKE nodes from storage-optimized Z4M machine series : Manually: starting from GKE version 1.36.3-gke.1767000 and later. Using compute clas…Mon 19 Oct
• FixedA security issue in GKE fleet management that could have allowed unauthorized configuration changes to clusters registered to a fleet has been resolved. The fix…Tue 20 Oct
• FixedThis is an update to the release note regarding the Cloud Storage FUSE CSI driver issue published on October 2, 2026 . This issue has been resolved. You can upg…Tue 20 Oct

Google SecOps Marketplace — 4

• ChangeSiemplify : Version 114.0 Added support for lazy case loading so that case data is no longer attached to the remote agent task when enabled by the platform in t…Wed 21 Oct
• ChangePalo Alto Cortex XDR : Version 34.0 Added the Entities To Ignore parameter to exclude alerts containing specified IP addresses, CIDR ranges, domains, file hashe…Wed 21 Oct
• ChangeGoogle Threat Intelligence : Version 22.0 Improved private submission handling when retrieving comments in the following action: Submit FileWed 21 Oct
• FeatureGoogle Threat Intelligence : Version 22.0 The following new connector has been added: Google Threat Intelligence - GTI Alerts ConnectorWed 21 Oct

Looker — 16

• AnnouncementThe latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Regular channel: Looker 26.20…Tue 20 Oct
• FeatureAutomated cataloging and ingestion of Looker (Google Cloud core) metadata with Knowledge Catalog is now generally available (GA). This includes support for addi…Wed 21 Oct
• AnnouncementLooker 26.22 will roll out to Looker (original) instances on the following schedule: Expected Looker (original) deployment start: Monday, October 26, 2026 Expec…Thu 22 Oct
• FixedAn issue has been fixed where table column options menus and search boxes appeared behind drill dialogs, which prevented users from interacting with them. This…Thu 22 Oct
• FixedAn issue has been fixed where configuring a LookML model could trigger unnecessary derived table rebuilds. This feature now performs as expected.Thu 22 Oct
• FixedAn issue has been fixed where the Show filters option was displayed on dashboard tiles that failed to load data in view mode. This feature now performs as expec…Thu 22 Oct
• FixedAn issue has been fixed where drilling into results that were filtered by string dimensions that contained backslashes returned zero rows. This feature now perf…Thu 22 Oct
• FixedAn issue has been fixed where pivoted queries in SQL Runner could fail to render or re-pivot unexpectedly. This feature now performs as expected.Thu 22 Oct
• FixedAn issue has been fixed where the View (Expanded / Full Screen) option appeared in the tile action menu on embedded dashboards in view mode. This feature now pe…Thu 22 Oct
• FixedAn issue has been fixed where custom visualization tiles were truncated in dashboard PDF exports when the Expand tables to show all rows option was enabled. Thi…Thu 22 Oct
• FixedTable row group subtotals are now displayed only for sum and count measures. For other measure types (such as averages and count distinct ) and table calculatio…Thu 22 Oct
• FixedThe System Activity query_metrics Explore now records connection acquisition time ( acquire_connection ) for queries that are canceled while waiting in the conn…Thu 22 Oct
• FixedConversational Analytics DELETE endpoints now return HTTP 404 Not Found instead of HTTP 204 No Content when you attempt to delete nonexistent resources.Thu 22 Oct
• FixedThe System Activity query_metrics Explore has been updated to accurately record model initialization time for models that are loaded from cache.Thu 22 Oct
• FixedAn issue has been fixed where adding a new series to a categorical chart, such as adding a new pivot value, could cause category bars to appear ungrouped. This…Thu 22 Oct
• FixedAn issue has been fixed in the TypeScript and JavaScript SDKs where calling methods that have only optional parameters without passing an empty object could res…Thu 22 Oct

Model Armor — 1

• FeatureYou can use custom organization policies to ensure that all new or updated Model Armor Template resources enforce required filters, like responsible AI or promp…Wed 21 Oct

Security Command Center — 1

• FeatureYou can view issues created by Correlated Threats and security graph rules at the folder or project level. On the Issues page, you can filter all issues by serv…Mon 19 Oct

Security bulletin — 3

• GCP-2026-069Published: 2026-10-19 Description Description Severity Notes Security vulnerabilities were discovered in Istio and Envoy Proxy ( ISTIO-SECURITY-2026-007 ). For…Mon 19 Oct
• GCP-2026-070Published: 2026-10-21 Description Description Severity Notes Two remote code execution vulnerabilities were found in the open-source PHP language . While Google…Wed 21 Oct
• GCP-2026-071Published: 2026-10-23 Description Description Severity Notes On Saturday, October 17, 2026, Google received a report from a security researcher regarding the co…Fri 23 Oct

Spanner — 1

• FeatureSpanner supports approximate aggregate functions for both GoogleSQL and PostgreSQL dialects. These functions produce statistical estimates of distinct counts, a…Tue 20 Oct

Virtual Private Cloud — 1

• FeatureGeneral Availability : VPC Flow Logs adds the following metadata annotations and packet drop reasons for Cloud NAT: Metadata annotations: connection.nat_ip , co…Mon 19 Oct

Official Google Cloud references

• Google Cloud release notes
• Google Cloud security bulletins
• Google Cloud blog
• GKE security bulletins
• VPC Flow Logs
• Cloud NAT overview