Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

Security dominated, in an unusual shape. Three bulletins landed — GCP-2026-055, 056 and 057 — and the one that asks most of you is about Next.js, a framework Google Cloud hosts but does not maintain. Google states plainly that its own backend services are not impacted and that customers hosting Next.js applications must take immediate action to secure their own workloads. The Critical-severity bulletin of the three, by contrast, asks for nothing at all: it was patched in May and disclosed this week. Away from security, Application Integration announced an authorization change that will require a configured run-as service account for anything triggered by a schedule or an event, which is the item most likely to break something quietly. Cloud Run gained instances in Preview, for long-lived and individually addressable workloads — a real widening of what the service is for. Networking closed out BYOIP for IPv6 at general availability, and Managed Service for Apache Airflow had its best week in a while.

Three bulletins, three completely different asks

Taken together these are a useful lesson in reading a bulletin for what it requires rather than for its severity label.

GCP-2026-055 — the platform is fine and you are not

A critical unauthenticated remote code execution vulnerability exists in Next.js and libheif when processing malicious image files. The attack path is Next.js image optimization: a crafted HEIF or AVIF file, mishandled by libheif when it processes clean aperture boxes, executes arbitrary code in the context of the application. The identifiers are GHSA-2xp9-vwfh-vxw4 and GHSA-g89c-p67h-r497.

What makes this the week's most important item is Google's framing of it. Backend services are not directly impacted and no action is required to secure the underlying infrastructure — but customers hosting Next.js applications on Google Cloud must take immediate action to secure their own workloads. The named surfaces are Cloud Run, GKE and App Engine. The remedy is manual: upgrade Next.js to 16.3.3 or 15.5.24 or later in package.json, rebuild container base images for libheif as upstream OS patches arrive, and redeploy so that running containers actually pick up the patched versions.

That last clause is the one that catches people. Upgrading the manifest is not the fix; the fix is a running container built from it. A managed platform that patches its own hosts continuously creates a reasonable expectation that patching is somebody else's job, and this bulletin exists to say that for the application layer it is not.

GCP-2026-056 — Critical, and nothing to do

An improper input validation vulnerability was found in the JDBC driver in BigQuery Data Transfer Service versions prior to 1 May 2026, tracked as CVE-2026-12717 and rated Critical. An authenticated attacker could use crafted JDBC connection string parameters to reach remote code execution in the connector container and escalate privileges in the tenant project. Google's instruction is one line: no customer action is required, the vulnerability was patched on 1 May 2026.

This is the right outcome and it is still worth sitting with. The window between the patch and the disclosure is nearly four months, during which the issue was fixed in a service customers do not operate and could not inspect. There was no point at which a customer decision would have changed anything. That is the actual bargain of a managed service, stated more plainly than usual: you exchange the ability to act for the obligation to trust, and the only evidence you get is a bulletin arriving after the fact saying it was handled.

GCP-2026-057 — thirteen Envoy CVEs, and the releases that carry them

A series of vulnerabilities were discovered in Envoy Proxy, rated Moderate to High, spanning thirteen CVEs from CVE-2026-48521 and CVE-2026-50572 through the CVE-2026-735xx range. The bulletin points at the Cloud Service Mesh security bulletin for instructions.

Read it alongside the release notes and the two line up: Cloud Service Mesh published 1.29.7-asm.2, 1.28.10-asm.24 and 1.27.9-asm.34 for in-cluster deployments in the same window. Three supported minor versions patched simultaneously is what a coordinated proxy fix looks like from the outside, and the version you need depends on which line you are on rather than on the bulletin.

The change most likely to break something quietly

Application Integration announced on Friday that it is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account.

The consequential sentence is the next one: integrations that run without a person — those started by a schedule or an event — will need an explicitly configured run-as service account. Google says action might be required before the change takes effect and points at a preparation guide.

Unattended automation is exactly the category nobody is watching. A scheduled integration that has worked for a year has no owner looking at it on a Tuesday morning, and the failure mode here is an authorization error at trigger time rather than anything visible at deploy time. This is worth an inventory pass now: list every integration with a schedule or event trigger, confirm each has a run-as service account, and confirm the callers hold permission to act as it.

Cloud Run grows something that stays running

Cloud Run instances are available in Preview, specifically designed for running long-lived and individually addressable workloads.

Both adjectives matter. Cloud Run's shape has been request-scoped and interchangeable: a revision behind a URL, replicas that are equivalent to one another, an instance you do not name. Long-lived and individually addressable is a different primitive, and it points at workloads that have been awkward on the service — stateful sessions, per-tenant workers, anything a caller must reach by identity rather than by round-robin.

It is Preview, so this is a thing to read about rather than a thing to plan on. The reason to note it now is directional: it narrows the gap that has historically pushed a workload from Cloud Run to GKE, and a team currently choosing between the two should know the choice is moving.

On the machine-series follow-up from roundup #2, where M4N reached general availability: Oracle on Google Cloud Compute now supports running Oracle workloads on M4N, which is the kind of second announcement that turns a hardware launch into a migration option.

Networking and the edge

• BYOIP for IPv6 reaches general availability. You can reserve static external IPv6 addresses from bring your own IP sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode, assignable to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. For anyone who owns address space and has been running dual-stack with borrowed Google IPv6, this closes the gap.
• The load balancer half arrived with it. For regional external passthrough Network Load Balancers, reserving specific or automatically allocated BYOIP IPv6 addresses before creating a forwarding rule is now supported — the two notes are one capability landing on both sides.
• SSL policy cross-project referencing is in Preview for Application Load Balancers and proxy Network Load Balancers. A single TLS policy defined once and referenced from load balancers in other projects is a real reduction in the drift that Shared VPC estates accumulate.

Data platform and operations

• Managed Service for Apache Airflow had the week's best run. Orchestration Pipelines are now generally available, the Managed Airflow remote Model Context Protocol server reached GA, and the Managed Airflow Agent is now in the console — it can help you understand, diagnose and resolve issues with failed Airflow tasks and DAG runs. Three GA-or-console milestones in one week is unusual for one product.
• VM Extension Manager extension policies for the Ops Agent are generally available, published under both Cloud Logging and Cloud Monitoring. Extension policies provide zonal and project-wide Ops Agent installation, version upgrades and configuration management — which moves agent rollout from a per-VM concern to a fleet one.
• Private Service Connect got easier to configure for Cloud SQL, announced across MySQL, PostgreSQL and SQL Server, with the configuration available at instance creation.
• Compute Engine published RHEL images pre-configured with LVM partitioning and RHEL Extended Update Support images, both generally available.

What I would act on

1. Find every Next.js deployment you run on Google Cloud and check its version. This is the only item this week with an active exploit path and a manual remedy. Upgrade to 16.3.3 or 15.5.24 or later, rebuild base images for libheif, and confirm the running containers are the rebuilt ones — a merged dependency bump that has not been redeployed has fixed nothing.
2. Inventory your unattended Application Integration runs before the authorization change lands. Anything triggered by a schedule or an event needs a run-as service account explicitly configured, and its callers need permission to act as that account. This will fail closed, on a schedule, with nobody watching.
3. Work out which Cloud Service Mesh line you are on and take the matching patch — 1.29.7-asm.2, 1.28.10-asm.24 or 1.27.9-asm.34. Thirteen Envoy CVEs is a large enough batch that "we will pick it up at the next upgrade" is the wrong posture.
4. If you own IP space and run dual-stack, revisit BYOIP now that IPv6 is GA. The reason to do it this quarter rather than next is that address migrations are cheapest before the estate grows around the borrowed addresses.

Complete inventory — all 193 notes

Everything Google Cloud published between 24 and 28 August 2026, from four feeds. Nothing is omitted; where a run of notes repeats the same text once per release, it is rolled up with its count intact and its identifiers listed, never deduplicated.

How this inventory reconciles

Google Cloud published 193 notes across 40 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (40 notes) — Security40 notes, across 4 releases (cos-117-18613-675-64, cos-121-18867-528-78, cos-125-19216-532-135, cos-129-19506-299-161). They fix 16 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-68093, CVE-2026-68096, CVE-2026-68116, CVE-2026-68129, CVE-2026-68146, CVE-2026-68147, CVE-2026-68149, CVE-2026-68171, CVE-2026-68296, CVE-2026-68299, CVE-2026-68325, CVE-2026-68329, CVE-2026-68338, CVE-2026-68386, CVE-2026-68422, CVE-2026-68428.
• Container Optimized OS (17 notes) — Fixed17 notes, across 4 releases (cos-117-18613-675-64, cos-121-18867-528-78, cos-125-19216-532-135, cos-129-19506-299-161). 11 distinct texts, each repeated once per release and counted individually:
  • Added support for net-fs/lustre-client-drivers v2.14.0_p259.
  • Upgraded app-admin/google-guest-configs to v20260804.00.
  • Upgraded app-arch/zstd to v1.5.7-r1.
  • Upgraded app-shells/dash to v0.5.13.5.
  • Upgraded dev-libs/expat to v2.8.3.
  • Upgraded dev-libs/libverto to v0.3.2-r1.
  • Upgraded dev-libs/popt to v1.19-r1.
  • Upgraded dev-libs/xxhash to v0.8.3-r2.
  • Upgraded sys-apps/acl to v2.4.0-r2.
  • Upgraded sys-apps/xemu to v0.0.10.
  • Upgraded sys-process/lsof to v4.99.7.

One change, published under several products

• FeatureCloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service…Published under 3 products: Cloud SQL for MySQL, Cloud SQL for PostgreSQL, Cloud SQL for SQL Server.
• AnnouncementScheduled maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. Durin…Published under 2 products: Google SecOps, Google SecOps SOAR.
• ChangeVM Extension Manager extension policies for the Ops Agent are Generally Available (GA) . Extension policies provide zonal and project-wide Ops Agent installatio…Published under 2 products: Cloud Logging, Cloud Monitoring.
• Feature[Spotlight Feature] Mandiant Frontline Threats rule packs Curated Detections has been enhanced with additional Mandiant Frontline Threats detections for Linux,…Published under 2 products: Google SecOps, Google SecOps SIEM.
• FeatureUse assessments ( Preview ) in Database Center to assess and test the performance impact of database recommendations before you apply them to your production da…Published under 2 products: Cloud SQL for PostgreSQL, Database Center.
• FeatureUnroll Processor for Data Processing Pipelines Google SecOps data processing pipelines now support the Unroll processor (event breaking). This processor allows…Published under 2 products: Google SecOps, Google SecOps SIEM.

Everything else, by product

Apigee X — 3

• AnnouncementOn August 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-4). Note: Rollouts of this release began today and may take four or more business…Thu 27 Aug
• FixedBug ID Description 507878328 Upgraded the Apigee runtime to run on JDK 17, while maintaining backward compatibility with JDK 11. 530965355 Added an opt-in Messa…Thu 27 Aug
• SecurityBug ID Description 544570126 Security fix for Apigee. Fixed a security issue in the PythonScript policy. N/A Security fix for Apigee infrastructure.Thu 27 Aug

Apigee hybrid — 2

• Announcementv1.14.8 On August 26, 2026 we released an updated version of the Apigee hybrid software, v1.14.8. For information on upgrading, see Upgrading Apigee hybrid to v…Wed 26 Aug · v1.14.8
• SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-39822 CVE-2026-42505 N/A Security fixes fo…Wed 26 Aug · v1.14.8

Application Integration — 1

• AnnouncementUpcoming authorization changes for integration runs Application Integration is updating how identities are handled for integration runs. Every run will act as e…Fri 28 Aug

Backup and DR — 1

• FeatureBackup vault support for Filestore instances encrypted with customer-managed encryption keys (CMEK) is now generally available (GA). When you back up Filestore…Mon 24 Aug

BigQuery — 7

• FeatureYou can now monitor the performance, adoption, latency, and costs of your data agents and their conversations by using Google Cloud Observability in BigQuery. T…Mon 24 Aug
• FeatureBigQuery data governance tags are supported in Terraform. This feature is in Preview .Tue 25 Aug
• FeatureYou can now view real-time logs for your Python UDFs in Cloud Logging. This feature is generally available .Wed 26 Aug
• SecurityAn Improper Input Validation vulnerability was discovered in the JDBC driver in BigQuery Data Transfer Service versions prior to May 1, 2026. An authenticated a…Wed 26 Aug
• AnnouncementCore graph processing for BigQuery Graph requires an Enterprise or Enterprise Plus edition reservation. Existing allowlisted users can continue to use Standard…Thu 27 Aug
• FeatureThe Data Engineering Agent is now HIPAA compliant . For more information, see HIPAA compliance on Google Cloud .Thu 27 Aug
• FeatureYou can now train models using XGBoost version 2.1 by using the XGBOOST_VERSION option. BigQuery uses the XGBoost 3.1.0 library to load and make predictions on…Thu 27 Aug

Blog — 14

• PostNew AI-powered quick assessments in Migration Center turbocharge modernizationMon 24 Aug
• PostEmpowering autonomous agents with advanced security governanceMon 24 Aug
• PostBringing gVisor sandboxes to distributed Ray clustersTue 25 Aug
• PostNow introducing Gemini Enterprise for LegalTue 25 Aug
• PostNow introducing Gemini Enterprise for Financial ServicesTue 25 Aug
• PostUsing OKF with Knowledge Catalog to serve context for agentsWed 26 Aug
• PostHow Uber improves network reliability while unblocking cloud migrationWed 26 Aug
• PostSimplify your resilience testing strategy with Fault Injection TestingWed 26 Aug
• PostFinOps for the AI era: New flexible billing and cost controls for agentsWed 26 Aug
• PostDynamic capacity management for AI infrastructureWed 26 Aug
• PostYour chance to start building AI agents from the absolute basicsWed 26 Aug
• PostReimagining work: How Pythian’s internal AI playbook delivers customer ROIThu 27 Aug
• PostDeploy personal AI agents with Cloud Run instancesThu 27 Aug
• PostWhat’s new with Google CloudFri 28 Aug

Cloud Build — 2

• SecurityAn Incorrect Authorization vulnerability CVE-2026-19410 , in GitHub Trigger Comment Control in Cloud Build, was fixed. No customer action is needed.Mon 24 Aug
• FeatureYou can now update access tokens from the Connection details page for your 2nd generation Bitbucket and 2nd generation Gitlab host connections. For more informa…Fri 28 Aug

Cloud Load Balancing — 2

• FeatureSSL policy cross-project referencing is now available for Application Load Balancers and proxy Network Load Balancers in Preview . You can use cross-project ref…Wed 26 Aug
• FeatureFor regional external passthrough Network Load Balancers, reserving specific or automatically allocated bring your own IP (BYOIP) IPv6 addresses before creating…Thu 27 Aug

Cloud Run — 1

• FeatureCloud Run instances are available in Preview . Instances are specifically designed for running long-lived and individually addressable workloads. To learn more,…Tue 25 Aug

Cloud SQL for PostgreSQL — 1

• ChangeThe rollout of the following extension upgrades is complete: pg_partman is upgraded from 5.2.4 to 5.4.3. pgfincore is upgraded from 1.3.1 to 1.4. pgvector is up…Thu 27 Aug

Cloud Service Mesh — 8

• Announcement1.29.7-asm.2 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Wed 26 Aug
• Announcement1.28.10-asm.24 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service M…Wed 26 Aug
• Announcement1.27.9-asm.34 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Me…Wed 26 Aug
• FeatureFor clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now supporte…Wed 26 Aug
• FixedPatch 1.29.7-asm.2 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-5704 Yes Yes No Yes Medium (5.5)Wed 26 Aug
• FixedPatch 1.28.10-asm.24 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-5704 Yes Yes No Yes Medium (5.5)Wed 26 Aug
• FixedPatch 1.27.9-asm.34 contains fixes for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-10536 Yes Yes No Yes Low (9.8) CVE-…Wed 26 Aug
• SecurityThe following images are now rolling out for managed Cloud Service Mesh: 1.21.6-asm.71 is rolling out to the rapid release channel. 1.20.8-asm.119 is rolling ou…Thu 27 Aug

Cloud Trace — 4

• FeatureYou can update the display name, description, and Cloud KMS key applied to a _Trace observability bucket. For more information, see Update observability buckets…Mon 24 Aug
• FeatureYou can manually create the _Trace observability bucket before your project receives trace data. When creating the bucket, you must specify a storage location.…Mon 24 Aug
• FeatureThe following remote MCP servers automatically generate a trace span for tools/call operations. Policy Troubleshooter Managed Service for Apache Airflow These s…Mon 24 Aug
• FeatureThe following remote MCP server automatically generates a trace span for tools/call operations. Datastream These spans can help you understand the behavior of y…Thu 27 Aug

Compute Engine — 2

• FeatureGenerally available : Red Hat Enterprise Linux (RHEL) images pre-configured with Logical Volume Manager (LVM) partitioning are available for Compute Engine in t…Wed 26 Aug
• FeatureGenerally available : Red Hat Enterprise Linux (RHEL) Extended Update Support (EUS) images are available for Compute Engine in the Google Cloud console. RHEL EU…Wed 26 Aug

Config Controller — 1

• ChangeConfig Controller now uses the following versions of its included products: Config Connector v1.155.1, release notesMon 24 Aug

Container Optimized OS — 7

• Changecos-121-18867-528-78 Kernel Docker Containerd GPU Drivers COS-6.6.143 v27.5.1 v2.0.10 See ListMon 24 Aug · cos-121-18867-528-78
• Changecos-117-18613-675-64 Kernel Docker Containerd GPU Drivers COS-6.6.143 v24.0.9 v1.7.34 See ListMon 24 Aug · cos-117-18613-675-64
• Changecos-129-19506-299-161 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.6 See ListMon 24 Aug · cos-129-19506-299-161
• ChangeUpdated cos-gpu-installer to v2.7.7.Mon 24 Aug · cos-129-19506-299-161
• Changecos-125-19216-532-135 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.7 See ListMon 24 Aug · cos-125-19216-532-135
• ChangeUpdated cos-gpu-installer to v2.7.7.Mon 24 Aug · cos-125-19216-532-135
• ChangeRuntime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068Mon 24 Aug · cos-125-19216-532-135

Gemini Enterprise — 4

• FeatureGemini Enterprise: D&B Commercial Graph data store (Preview) The D&B Commercial Graph data store is available in Public Preview in Gemini Enterprise. You can co…Mon 24 Aug
• FeatureGemini Enterprise: Cloud Monitoring observability for data connectors Cloud Monitoring telemetry for Gemini Enterprise data connectors (also referred to as data…Mon 24 Aug
• FeatureGemini Enterprise: Updates to A2UI Material catalog component properties The A2UI component gallery reference has been updated to reflect the latest A2UI versio…Wed 26 Aug
• FeatureGemini Enterprise: New data stores and support for new actions (Preview) The following data stores are available in Public Preview in Gemini Enterprise: Campfir…Fri 28 Aug

Gemini Enterprise Agent Platform — 3

• FeatureGLM 5.2 is available in Public Preview GLM 5.2 from Z.ai is available as a fully managed model (MaaS) in Model Garden. The model targets long-horizon agentic an…Mon 24 Aug
• FeatureCodeMender updates This release introduces updates to CodeMender: Model support : Support for Gemini 3.6 Flash ( gemini-3.6-flash ) and Gemini 3.7 Flash ( gemin…Thu 27 Aug
• FeatureGemini Omni 1.1 Flash is available in Public Preview Gemini Omni 1.1 Flash ( gemini-omni-1.1-flash-preview ) is available in Preview . Gemini Omni 1.1 Flash is…Thu 27 Aug

Google Cloud Contact Center as a Service — 3

• AnnouncementGoogle Cloud CCaaS 6.7 We've released version 6.7 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you h…Thu 27 Aug
• FeatureBulk email status updates You can use the new apps/api/v1/email/update_status endpoint to change the status of multiple email sessions to the status that you sp…Thu 27 Aug
• FixedThis release addresses the following issues: Fixed an issue where blended SMS transcripts were incorrectly identified as call audio recordings when uploaded to…Thu 27 Aug

Google Cloud Managed Service for Apache Kafka — 1

• FeatureYou can now configure the disk capacity per broker when you create a Kafka cluster and increase it later. For more information, see Configure broker disk size .Thu 27 Aug

Google Cloud VMware Engine — 1

• AnnouncementVMware component updates: The VMware Engine operations team is updating vCenter Server and ESXi to version 8.0 Update 3k to address security vulnerabilities des…Mon 24 Aug

Google Distributed Cloud (software only) for VMware — 3

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.36.0-gke.532 is now available for download. To upgrade, see Upgrade a cluster . Google Distributed Cloud 1…Tue 25 Aug
• FeatureGoogle Distributed Cloud (software only) for VMware includes the following feature enhancements: Updated the Kubernetes version to 1.36. Upgraded containerd fro…Tue 25 Aug
• FixedThe following issues were fixed in 1.36.0-gke.532: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where user clusters remained stuck in a…Tue 25 Aug

Google Distributed Cloud (software only) for bare metal — 3

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.36.0-gke.532 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Clou…Tue 25 Aug
• FeatureGoogle Distributed Cloud (software only) for bare metal includes the following feature enhancements: Upgraded the Ansible version to 2.18. This version requires…Tue 25 Aug
• FixedThe following issues were fixed in 1.36.0-gke.532: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where CA certificate secrets with identi…Tue 25 Aug

Google Kubernetes Engine — 15

• FixedFixed the issue in which GPUDirect-TCPX for a3-highgpu-8g machine types was incompatible with the Linux kernel version that was used by Container-Optimized OS i…Tue 25 Aug
• Change(2026-R36) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Wed 26 Aug
• Change(2026-R36) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 26 Aug
• Change(2026-R36) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 26 Aug
• Change(2026-R36) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 26 Aug
• Change(2026-R36) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 26 Aug
• Change(2026-R36) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 26 Aug
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 26 Aug
• FeatureIn GKE version 1.36 and later, GCPAuthzPolicy and GCPAuthzExtension resources for GKE Gateway are now available in Preview. You can use these resources to enfor…Wed 26 Aug
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 26 Aug
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 26 Aug
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 26 Aug
• Security(2026-R36) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Wed 26 Aug
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 26 Aug
• FeatureNetwork Endpoint Group (NEG) pre-provisioning is now available in Preview. With this feature, you can force the creation of empty zonal GCE_VM_IP_PORT NEGs in s…Thu 27 Aug

Google SecOps — 1

• Feature[Spotlight Feature] Operations in Emerging Threats Center Google SecOps now supports Operations in the Emerging Threats Center feed to provide rapid visibility…Mon 24 Aug

Google SecOps Marketplace — 6

• ChangeMicrosoft Graph Mail : Version 46.0 Updated parameters and filtering options in the following actions: Wait For Email From User Search EmailsWed 26 Aug
• ChangeMicrosoft Graph Mail Delegated : Version 23.0 Updated parameters and filtering options in the following actions: Wait For Email From User Search EmailsWed 26 Aug
• ChangeServiceNow : Version 71.0 Added support for OAuth authentication in the following job: Sync Incidents JobWed 26 Aug
• FeatureFireEye HX : Version 26.0 Added the following new actions: Get File Check Containment Status Added the Agent Id input parameter to the following actions: Contai…Wed 26 Aug
• FeatureProofpoint Email Protection : Version 11.0 Added the following new actions: Forward Quarantined Email Release Quarantined EmailWed 26 Aug
• FeatureWiz : Version 10.0 Added the Authentication URL parameter to support Gov (FedRAMP) and custom environments. Added the following new job: Wiz and Google SecOps B…Wed 26 Aug

Knowledge Catalog — 1

• FeatureKnowledge Catalog support for importing metadata from dbt Core and MetricFlow is available in Preview . You can use the gcloud alpha dataplex dbt metadata-jobs…Wed 26 Aug

Looker — 15

• AnnouncementFrom August 24 through August 26, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.14.Fri 28 Aug
• AnnouncementLooker now supports connections to MongoSQL . Although existing connections to the legacy MongoDB Connector for BI are still fully supported, Looker recommends…Fri 28 Aug
• ChangeThe Google Maps Enhancements preview feature now includes the following features: The Dual-axis Map option now supports points and circles. You can now specify…Fri 28 Aug
• ChangeWhen the New Looker Explore and Merge Query Experience preview features are enabled, editing a merge query tile on a dashboard now opens the Join data page dire…Fri 28 Aug
• ChangeThe Conversational Analytics System Activity dashboard Token usage tab now includes observability information about top users and top conversations by token usa…Fri 28 Aug
• ChangeWhen connecting Looker to your database, you can specify additional Java Database Connectivity (JDBC) parameters . To maintain security, Looker restricts the al…Fri 28 Aug
• ChangeLooker Continuous Integration (CI) can be triggered from GitLab CI, Bitbucket Pipelines, and GitHub Actions workflows by using the Looker API and the official L…Fri 28 Aug
• FeatureThe Advanced Unused Content Cleanup feature is now generally available.Fri 28 Aug
• FeatureConversational Analytics verified queries , also known as golden queries , are now generally available. You can also now define verified queries in Looker (Goog…Fri 28 Aug
• FeatureYou can now configure Continuous Integration to automatically run CI suites when a dbt Cloud CI job finishes . The CI suite run verifies whether changes in your…Fri 28 Aug
• FeatureNow available in preview, the New/Edit Roles Enhancement feature provides a modernized, step-by-step interface for creating and editing roles on the Roles page…Fri 28 Aug
• FeatureNow available in preview, you can define and chat with data agents on a LookML dashboard . To use this feature, the Conversational Analytics and Enable Dashboar…Fri 28 Aug
• FeatureNow available in preview , you can define Looker-managed, in-database analytic models directly from existing LookML Explores by using the model_source subparame…Fri 28 Aug
• FixedDashboard parameter filters now correctly respect manually restricted option lists when determining default values. This prevents filters from reverting to base…Fri 28 Aug
• FixedTiles that are on dashboard tabs will now run only when the dashboard tab that they are saved on is opened.Fri 28 Aug

Managed Service for Apache Airflow — 3

• FeatureManaged Airflow remote Model Context Protocol (MCP) server is now generally available (GA).Tue 25 Aug
• FeatureManaged Airflow Agent is now available in Google Cloud Console. The agent can help you understand, diagnose, and resolve issues with failed Airflow tasks and DA…Tue 25 Aug
• FeatureOrchestration Pipelines are now generally available (GA) .Fri 28 Aug

Oracle on Google Cloud Compute — 2

• FeatureOracle on Google Cloud Compute supports running Oracle workloads on Compute Engine's M4N machine series that provides leading block storage performance with Hyp…Wed 26 Aug
• FeatureOracle on Google Cloud Compute offers in-depth documentation that describes how to deploy Oracle AI Database workloads using Google Cloud NetApp Volumes. For mo…Wed 26 Aug

Security bulletin — 3

• GCP-2026-055Published: 2026-08-25 Description Description Severity Notes A critical unauthenticated Remote Code Execution (RCE) vulnerability exists in Next.js and libheif…Tue 25 Aug
• GCP-2026-056Published: 2026-08-26 Description Description Severity Notes An Improper Input Validation vulnerability was discovered in the JDBC driver in BigQuery Data Trans…Wed 26 Aug
• GCP-2026-057Published: 2026-08-26 Description Description Severity Notes A series of vulnerabilities were discovered in Envoy Proxy. For instructions and more details, see…Wed 26 Aug

VPC Service Controls — 1

• FeaturePreview stage support for the following integration: Cloud FTPWed 26 Aug

Virtual Private Cloud — 1

• FeatureGeneral availability : You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING…Thu 27 Aug

reCAPTCHA — 1

• ChangeFraud Defense Mobile SDK v18.10.0-beta01 is available for iOS. This version includes the following: Adds support for macOS desktop and tvOS. Improvements to net…Tue 25 Aug

Official Google Cloud references

• Google Cloud security bulletins
• Application Integration release notes
• Cloud Run release notes
• Virtual Private Cloud release notes
• Cloud Load Balancing release notes
• Cloud Monitoring release notes
• Managed Service for Apache Airflow release notes
• Cloud Service Mesh release notes
• Compute Engine release notes
• Google Cloud release notes, all products