Home› Blog› GCP Weekly Intelligence #12 - 26-30 October 2026
GCP Weekly Intelligence GCP

GCP Weekly Intelligence #12

Two security bulletins disclosed weeks after they were fixed, two dated Cloud DNS behaviour changes worth diarising, and 231 notes across five working days.

Oct 31, 2026 30 min read
Verified against current vendor documentation on 31 October 2026. Pricing, limits and API behaviour were checked against the official docs on that date. Cloud services change fast — if you are reading this much later, treat the specifics as a starting point and re-check the linked sources.
GCP Weekly Intelligence · #12 · 26–30 October 2026
Jayanth Katta 31 Oct 2026 Google Cloud · Weekly Intelligence
In this post

The week in one paragraph

Two hundred and thirty-one notes across Monday to Friday, and the two that matter most are both security bulletins describing vulnerabilities that were already closed before anyone outside Google knew they existed. Beyond those, the week's most consequential item is not a feature at all: Cloud DNS published two behaviour changes taking effect on 5 January 2027, one of which alters the order in which private and public zones are consulted. That is the kind of change that breaks resolution in estates nobody touched. The rest of the week was Looker and the agent platforms — Looker alone accounted for 22 notes — plus a steady run of GKE channel releases and Container-Optimized OS rebuilds.

Two bulletins, both already patched

Both of this week's bulletins follow the same pattern, and it is a pattern worth naming because it changes how you should read them.

GCP-2026-074, published 28 October and rated Critical, is a Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. The impact is as bad as that class gets: an authenticated user could use a maliciously crafted serialized object to execute arbitrary code. It carries CVE-2026-93327. And the resolution is already done — this vulnerability was patched on September 11, 2026, with no customer action is required.

GCP-2026-073, published 26 October and rated High, is more directly interesting to anyone who has been following the IAM material in the architecture series: an incorrect authorization vulnerability in Compute Engine versions prior to August 31, 2026 allows a user to exfiltrate disk data without the required IAM permissions. Again closed in advance — this vulnerability was patched on August 31, 2026, and no action is required from you. Compute Engine's own release notes carry the matching line: a vulnerability (CVE-2026-85299) about incorrect authorization in Compute Engine was discovered and has been addressed.

The gap between fix and disclosure

GCP-2026-073 was patched on 31 August and disclosed on 26 October — fifty-six days later. GCP-2026-074 was patched on 11 September and disclosed on 28 October, forty-seven days. Neither gap is unusual or improper; coordinated disclosure after a fix is the correct order. But it does mean a weekly roundup of bulletins is a record of what Google has finished dealing with, not a list of what is currently at risk. The actionable content of both bulletins is the same sentence: no action is required. The useful content is the class of bug — an authorization check that could be bypassed to read disk data without the IAM permission that was supposed to gate it, which is a reminder that an IAM grant is a statement of intent enforced by code.

Cloud DNS changes resolution order in January

This is the item I would put in front of a network team, because it changes behaviour on a date rather than offering a feature. Starting January 5, 2027, CNAME chasing behavior will change so that Cloud DNS follows CNAME chains between public and private zones. The consequence is stated plainly: if your private zones or response policies have overlapping domain names with public CNAME targets, queries might resolve to unintended internal IP addresses or return resolution errors.

The mechanism is a widening of scope. Today, a CNAME answer from a public zone is chased only through public zones and internal DNS; from January, subsequent queries follow the complete VPC name resolution order: response policies, private zones, forwarding or peering zones, internal DNS, and public zones. The same widening applies to answers from private zones and from response policy zones. So a name that resolves one way today can resolve to an internal address afterwards, with no configuration change on your side.

Google's own guidance is unusually specific about what to do, which is itself a signal: review your CNAME chasing needs before January 5, 2027, and test your DNS query paths using dig or nslookup to identify CNAME chasing scenarios.

The second DNS change lands on the same date and is narrower: starting January 5, 2027, Cloud DNS will disable full responses to DNS queries of type ANY in public authoritative zones, returning a single resource record instead. ANY queries are mostly used by diagnostic tooling and by reflection-amplification abuse, so the blast radius is small — but any monitoring script that parses an ANY response will stop seeing what it expects.

Networking, IAM and the rest

Three items outside DNS are worth more than an inventory line.

Cloud Armor gained request-body inspection. Cloud Armor supports advanced match conditions to include attributes for inspecting request body content and parameters, and this lets you write custom CEL rules to act on them. Until now, custom rules worked largely on headers, paths and IP attributes; matching on body content moves a class of filtering out of the application and into the edge.

Application Load Balancers got regex URL rewrites. Regular expression URL rewrites ( regexRewrite ) for route rules in URL maps are now generally available (GA) for Application Load Balancers. That removes a standing reason to keep a rewriting proxy in front of a load balancer.

IAM published three new basic roles. The Admin ( roles/admin ), Writer ( roles/writer ), and Reader ( roles/reader ) basic roles are generally available ( GA ). Worth a careful look rather than enthusiasm: the existing basic roles (Owner, Editor, Viewer) are the ones every hardening guide tells you to stop using because they are too broad, and a new set of basic roles is a new set of broad grants. The interesting question is whether these are narrower than their predecessors or merely differently named, and that is a question for the roles reference rather than for a release note.

The volume this week sat in the data and agent products rather than infrastructure. Looker led with 22 notes, including data lineage reaching GA and a Looker-managed Model Context Protocol server going GA. Google Kubernetes Engine contributed 14, almost all channel releases across Rapid, Regular, Extended and the deprecated no-channel track. Gemini Enterprise Agent Platform had 10, Container-Optimized OS 9, and Google SecOps Marketplace 9. Nothing in the firewall, routing or Shared VPC surfaces this series is currently working through changed at all.

What I would act on

  1. Diarise 5 January 2027 and test CNAME chains now. This is the only item this week that can break a working estate without anyone changing anything. Run the dig and nslookup checks Google asks for, and specifically look for names that exist in both a private zone and a public CNAME target — that overlap is the failure condition.
  2. Check whether anything parses ANY responses. Same date, much smaller surface. Monitoring and inventory scripts are the likely callers.
  3. Read the new basic roles before anyone grants one. Three new basic roles reaching GA is the sort of change that gets adopted by convenience. Establish whether roles/reader is narrower than roles/viewer before it appears in a policy.
  4. Nothing to do for either bulletin. Both were patched by Google weeks before disclosure and both say so explicitly. Record them and move on — and note GCP-2026-073's class, because an authorization bypass that reads disk data without the gating IAM permission is a useful argument for defence in depth behind IAM.

Complete inventory — all 231 notes

Built from the combined release-notes feed, the security bulletins feed, the GKE bulletins feed and the Cloud Blog feed by build_weekly_inventory_gcp.py, for the news window Monday 26 to Friday 30 October 2026. Every raw note lands in exactly one bucket and the buckets are asserted to sum to the raw total; every link was fetched and every day anchor confirmed present.

How this inventory reconciles

Google Cloud published 231 notes across 49 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

BucketNotesWhy
Listed individually173Every note that is its own distinct fact.
Published under several products21 texts issued once per runtime or service; shown once, with the products named.
Repeating runs, rolled up563 product/type runs where the same text recurs once per release. Summarised with the full identifier list, not deduplicated.
Total231 

Repeating runs, rolled up

  • Container Optimized OS (28 notes) — Security28 notes, across 5 releases (cos-121-18867-652-12, cos-125-19216-760-20, cos-129-19506-578-21, cos-133-19999-44-174, cos-dev-138-20248-0-0). They fix 20 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2024-4741, CVE-2026-111497, CVE-2026-111943, CVE-2026-15308, CVE-2026-19445, CVE-2026-33186, CVE-2026-39822, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-42508, CVE-2026-46595, CVE-2026-5435, CVE-2026-77214, CVE-2026-82474, CVE-2026-84445, CVE-2026-94447, CVE-2026-98432, CVE-2026-99999.
  • Container Optimized OS (16 notes) — Change16 notes, across 6 releases (cos-121-18867-652-12, cos-125-19216-760-20, cos-129-19506-578-21, cos-133-19999-44-174, cos-beta-133-19999-44-170, cos-dev-138-20248-0-0). 12 distinct texts, each repeated once per release and counted individually:
    • Runtime sysctl changes: Changed: fs.epoll.max_user_watches: 1807671 -> 1807627 Changed: fs.fanotify.max_user_marks: 68382 -> 68378 Changed: fs.inotify.max_user_…
    • Runtime sysctl changes: Changed: fs.epoll.max_user_watches: 1808562 -> 1808517 Changed: fs.fanotify.max_user_marks: 68416 -> 68412 Changed: fs.inotify.max_user_…
    • Runtime sysctl changes: Changed: fs.epoll.max_user_watches: 1809051 -> 1809007 Changed: kernel.threads-max: 63204 -> 63199 Changed: net.ipv4.tcp_mem: 94044 1253…
    • Updated app-admin/google-guest-configs to v20261025.00.
    • Updated the Linux kernel to v6.18.57.
    • Upgraded sys-apps/casfs to v0.1.24.
    • cos-121-18867-652-12 Kernel Docker Containerd GPU Drivers COS-6.6.159 v27.5.1 v2.0.10 See List
    • cos-125-19216-760-20 Kernel Docker Containerd GPU Drivers COS-6.12.113 v27.5.1 v2.2.7 See List
    • cos-129-19506-578-21 Kernel Docker Containerd GPU Drivers COS-6.12.113 v27.5.1 v2.2.7 See List
    • cos-133-19999-44-174 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See List
    • cos-beta-133-19999-44-170 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See List
    • cos-dev-138-20248-0-0 Kernel Docker Containerd GPU Drivers COS-6.18.57 v29.4.3 v2.4.1 See List
  • Google Kubernetes Engine (12 notes) — Change12 notes. 4 distinct texts, each repeated once per release and counted individually:
    • (2026-R45) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…
    • (2026-R45) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…
    • (2026-R46) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…
    • (2026-R46) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…

One change, published under several products

  • AnnouncementFinal shutdown of legacy managed BigQuery export datasets (chronicle-tla) for non-Enterprise+ customers Following the March 26, 2025 deprecation announcement ,…Published under 2 products: Google SecOps, Google SecOps SIEM.

Everything else, by product

Agent Platform Workbench — 8

  • Change20261025.00_p0 ReleaseMon 26 Oct · 20261025.00_p0
  • ChangeInstalled latest packages from upstream dependencies.Mon 26 Oct · 20261025.00_p0
  • Change20261025.00_p0 ReleaseMon 26 Oct · 20261025.00_p0
  • ChangeInstalled latest packages from upstream dependencies.Mon 26 Oct · 20261025.00_p0
  • FeatureCustom organization policies for Agent Platform Workbench instances You can now use custom organization policies to allow or deny the creation and update of Age…Mon 26 Oct · 20261025.00_p0
  • SecurityUpdated certifi, pip, and conda ca-certificates to the latest versions.Mon 26 Oct · 20261025.00_p0
  • SecurityAddressed multiple reported security vulnerabilities in bundled packages.Mon 26 Oct · 20261025.00_p0
  • SecurityUpdated certifi, pip, and conda ca-certificates to the latest versions.Mon 26 Oct · 20261025.00_p0

Agent Registry — 1

  • FeatureAgent Registry supports cross-project management boundaries ( Preview ), letting you centrally discover, search, and govern AI agents, Model Context Protocol (M…Fri 30 Oct

AlloyDB for PostgreSQL — 7

  • AnnouncementThe following AlloyDB AI functions and improvements are available in Preview : The ai.extract function lets you extract structured data from unstructured text d…Tue 27 Oct
  • AnnouncementThe following AlloyDB AI and vector search features and improvements are generally available ( GA ): The alloydb_scann extension supports four-level tree (4LT)…Wed 28 Oct
  • FeatureIdentity and Access Management (IAM) group authentication is generally available ( GA ) for new and existing AlloyDB clusters running PostgreSQL 15 and later. W…Wed 28 Oct
  • FixedAlloyDB provides more accurate memory usage estimation and prevents out-of-memory (OOM) errors when you build a ScaNN four-level tree index . This feature is in…Wed 28 Oct
  • SecurityIn response to GCP-2026-071 , Google is updating AlloyDB managed components. The fix to the certificate store is shipped in a new maintenance version that Alloy…Wed 28 Oct
  • FeatureAlloyDB AI adds pre-registered support for the following Gemini models in version 1.6.5 and later of the google_ml_integration extension: gemini-3.1-flash-lite…Thu 29 Oct
  • FixedFor AlloyDB clusters compatible with PostgreSQL 18 or later, an instance restart is no longer required when you enable or edit Advanced Query Insights settings,…Fri 30 Oct

Anti Money Laundering AI — 1

  • AnnouncementNew minor engine version released for the retail line of business within the v004.011 version line ( aml-retail.default.v004.011.202610-000 ). This version exte…Thu 29 Oct

Apigee hybrid — 6

  • Announcementv1.17.3 On October 29, 2026 we released an updated version of the Apigee hybrid software, v1.17.3. For information on upgrading, see Upgrading Apigee hybrid to…Thu 29 Oct · v1.17.3
  • FixedFixed in this release Bug ID Description 578314600 Fixed an issue where apigee-connect-agent ignored HTTPS_PROXY and failed to establish a tether in clusters th…Thu 29 Oct · v1.17.3
  • SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-56857 CVE-2026-56866 CVE-2026-63209 CVE-20…Thu 29 Oct · v1.17.3
  • Announcementv1.16.13 On October 30, 2026 we released an updated version of the Apigee hybrid software, v1.16.13. For information about upgrading, see Upgrading Apigee hybri…Fri 30 Oct · v1.16.13
  • FixedFixed in this release Bug ID Description 578314600 Fixed an issue where apigee-connect-agent ignored HTTPS_PROXY and failed to establish a tether in clusters th…Fri 30 Oct · v1.16.13
  • SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-63209 CVE-2026-81870 N/A Security fixes fo…Fri 30 Oct · v1.16.13

Application Integration — 2

  • FeatureApplication Integration agent skills Application Integration agent skills are available in the public google/skills repository: application-integration-basics ,…Wed 28 Oct
  • SecurityA Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. For mo…Wed 28 Oct

Backup and DR — 1

  • FeatureYou can now edit existing backup plans for Cloud SQL instances to update settings such as backup rules and maximum custom on-demand retention periods. To learn…Fri 30 Oct

BigQuery — 8

  • FeatureConversation logging for Conversational analytics in BigQuery is now generally available (GA). You can log data agent conversations to a BigQuery table in the a…Mon 26 Oct
  • FeaturePython user-defined functions now support volume mounts , which let you access dependency files from Cloud Storage directly from your Python UDF code. This feat…Mon 26 Oct
  • FeatureThe REGEXP_EXTRACT_GROUPS function produces substrings that match multiple capturing groups in a regular expression. This function is in Preview .Mon 26 Oct
  • FeatureYou can manage and version control SQL scripts and notebooks with BigQuery Studio Git repositories , which provide a streamlined, folder-based integration with…Tue 27 Oct
  • FeatureThe Data Engineering Agent now integrates with Google Drive , letting you provide Google Sheets files, CSV, or JSONL files as input for your data engineering pi…Tue 27 Oct
  • FeatureYou can now use conversational analytics in Connected Sheets to ask questions and analyze your BigQuery data using natural language. The Gemini side panel can h…Tue 27 Oct
  • FeatureThe AI.COUNT_TOKENS function , which estimates the token count of a text string, is generally available (GA).Tue 27 Oct
  • FeatureYou can now retrieve query results directly in the Apache Arrow format for faster retrieval speed and improved serialization efficiency. This feature is in Prev…Fri 30 Oct

Bigtable — 3

  • FeatureYou can use Apache Avro schema bundles to query individual fields within Avro records stored as serialized bytes in Bigtable. You can query your Avro data using…Tue 27 Oct
  • FeatureYou can configure Bigtable tables with microsecond timestamp granularity to capture and store high-frequency data. By supporting microsecond precision for cell…Wed 28 Oct
  • FeatureYou can use Knowledge Catalog to discover authorized views, logical views, and continuous materialized views. This integration lets you search for these granula…Fri 30 Oct

Blog — 20

  • PostIntroducing VMware solution on Google CloudTue 27 Oct
  • PostPowering the agentic enterprise with latest innovations in Oracle AI Database@Google CloudTue 27 Oct
  • PostSecurely connecting Gemini Enterprise to Snowflake dataTue 27 Oct
  • PostScale agents securely with IAM Helper Agent Skills and MCP ToolsTue 27 Oct
  • PostBringing Google TPUs to Oracle Cloud InfrastructureTue 27 Oct
  • PostIntroducing the AlloyDB Omni web UI for easier cluster observabilityWed 28 Oct
  • PostBehind the scenes, two months later: How we ship Google Agent Skills like productsWed 28 Oct
  • PostHow to troubleshoot GKE workloads faster with VPC Flow LogsWed 28 Oct
  • PostHow GKE networking scales to support high densities of concurrent AI agentsWed 28 Oct
  • PostNear-zero downtime upgrades: Announcing Cloud SQL for MySQL blue-green deploymentsWed 28 Oct
  • PostStep into a new dimension with XREAL AURA, the first-of-its-kind wired XR glassesWed 28 Oct
  • PostCloud CISO Perspectives: Introducing new $250,000 tier for Google Cloud VRP (Q&A)Thu 29 Oct
  • PostQuerying Databricks Apache Iceberg Tables with the borderless LakehouseThu 29 Oct
  • PostGrounding agents in one context graph connecting semantic models you already trustThu 29 Oct
  • PostWhat’s new with Google Data CloudThu 29 Oct
  • PostWhat’s new in AI infrastructure and orchestration in OctoberFri 30 Oct
  • PostWhen the Kubernetes API went silent: A three-layer networking mysteryFri 30 Oct
  • PostInnovate on your own business terms: Google Cloud spend caps now generally availableFri 30 Oct
  • PostWhat’s new with Google CloudFri 30 Oct
  • PostNew Gemini courses for financial services and legal teamsFri 30 Oct

Cloud Asset Inventory — 1

  • FeatureThe following resource types are publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , Feed , and Search ( SearchAllR…Wed 28 Oct

Cloud DNS — 2

  • AnnouncementStarting January 5, 2027, CNAME chasing behavior will change so that Cloud DNS follows CNAME chains between public and private zones. If your private zones or r…Tue 27 Oct
  • AnnouncementStarting January 5, 2027, Cloud DNS will disable full responses to DNS queries of type ANY ( QTYPE=ANY ) in public authoritative zones . Instead, a single resou…Tue 27 Oct

Cloud Database Migration Service — 2

  • FeatureYou can now create heterogeneous conversion workspaces by importing database schema metadata files from a Cloud Storage bucket without requiring direct network…Mon 26 Oct
  • FeatureDatabase Migration Service for homogeneous SQL Server migrations now supports Distributed Availability Group (DAG) migrations in general availability ( GA ). Wi…Wed 28 Oct

Cloud Load Balancing — 1

  • FeatureRegular expression URL rewrites ( regexRewrite ) for route rules in URL maps are now generally available (GA) for Application Load Balancers. You can use regula…Tue 27 Oct

Cloud Number Registry — 1

  • BreakingStarting November 25, 2026, if your configuration doesn't have a designated project, Cloud Number Registry will stop discovering resources. For more information…Fri 30 Oct

Cloud Run — 1

  • FeatureYou can run Cloud Run jobs with GPUs enabled for up to 12 hours ( Preview ).Fri 30 Oct

Cloud SQL for MySQL — 2

  • FeatureManaged replica indexes for Cloud SQL for MySQL are generally available ( GA ). This feature lets you automatically retain and restore secondary indexes on read…Wed 28 Oct
  • AnnouncementStarting November 1, 2026, at 02:00 a.m. local time, unpatched Cloud SQL for MySQL instances that evaluate certain local Canadian time zones (across Alberta, Br…Fri 30 Oct

Cloud SQL for PostgreSQL — 1

  • AnnouncementStarting November 1, 2026, at 02:00 a.m. local time, unpatched Cloud SQL for PostgreSQL instances that evaluate certain local Canadian time zones (across Albert…Fri 30 Oct

Cloud SQL for SQL Server — 1

  • AnnouncementStarting November 1, 2026, at 02:00 a.m. local time, Cloud SQL for SQL Server instances that evaluate certain local Canadian time zones (across Alberta, British…Fri 30 Oct

Cloud Storage — 1

  • FeatureSecurity and compliance findings in Storage Intelligence advisor are available in Preview . You can use these findings to identify buckets with objects that vio…Fri 30 Oct

Compute Engine — 1

  • SecurityA vulnerability (CVE-2026-85299) about incorrect authorization in Compute Engine was discovered and has been addressed. For more information, see the GCP-2026-0…Mon 26 Oct

Confidential Space — 1

  • AnnouncementA new Confidential Space image (261001) is available. This image removes compromised CA certificates from the OS trust store. See the security bulletin for more…Wed 28 Oct

Config Connector — 6

  • AnnouncementConfig Connector version 1.160.0 is now available.Tue 27 Oct
  • ChangeReconciliation Improvements: Added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct reconciler…Tue 27 Oct
  • FeatureNew Alpha Resources (Direct Reconciler): CCInsightsAnalysisRule Manage Customer Experience Insights analysis rules to define rules for analyzing conversational…Tue 27 Oct
  • FeatureNew Fields: BigtableTable Added support for spec.columnFamily[].type . MemorystoreInstance Added support for spec.gcsSource . MonitoringDashboard Added support…Tue 27 Oct
  • FeatureNew Features: Added support for a configurable maximum exponential backoff delay ceiling and retry halting for direct controllers by using the cnrm.cloud.google…Tue 27 Oct
  • FixedBug Fixes: AlloyDBCluster ( #13963 ) Fixed false-positive diffs on labels , initialUser , and network during takeover and re-reconciliation in the direct contro…Tue 27 Oct

Container Optimized OS — 9

  • FeatureAdded KVM virtualization support for AMD CPUID faulting.Tue 27 Oct · cos-dev-138-20248-0-0
  • FeatureAdded nvidia-container-toolkit to ARM images.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedUpdated cos-gpu-installer to v2.7.11 and toolbox to v20261020.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedUpgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedUpgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedUpgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedUpgraded sys-libs/glibc to v2.41-r5.Tue 27 Oct · cos-dev-138-20248-0-0
  • FixedFixed a 60 second outage after an idpf function reset on IPU E2100 caused by misreading PFGEN_RSTAT.Tue 27 Oct · cos-125-19216-760-20
  • FixedFixed a 60 second outage after an idpf function reset on IPU E2100 caused by misreading PFGEN_RSTAT.Tue 27 Oct · cos-129-19506-578-21

Dataflow — 1

  • FeatureDataflow has added the following features to tune horizontal autoscaling for Streaming Engine jobs: Latency tiers: You can configure the backlog threshold by ch…Thu 29 Oct

Datastream — 1

  • FeatureDatastream integration with Knowledge Catalog is now generally available (GA) . For more information, see the documentation .Fri 30 Oct

Dialogflow — 1

  • SecurityDialogflow ES : The Dialogflow ES LINE integration validates the X-Line-Signature HTTP header on incoming webhook requests using your LINE channel secret and re…Thu 29 Oct

Gemini — 1

  • OtherBug fixes in VS Code Various bug fixes and minor product enhancements.Thu 29 Oct · Bug

Gemini Enterprise — 4

  • FeatureGemini Enterprise: VPC connectivity and static IP egress for custom MCP servers You can configure Virtual Private Cloud (VPC) connectivity for custom Model Cont…Tue 27 Oct
  • FeatureGemini Enterprise: Support for Brazil ( br ) region (GA with allowlist) You can use the Gemini Enterprise app in the Brazil ( br ) in-country region with at-res…Wed 28 Oct
  • FeatureGemini Notebook Enterprise: Visual refresh This update includes the following changes and features. These features are generally available (GA): Refreshed UI de…Fri 30 Oct
  • FeatureGemini Enterprise: S&P Global - Adaptive Retrieval data store (Preview) The S&P Global - Adaptive Retrieval data store is available in Public Preview in Gemini…Fri 30 Oct

Gemini Enterprise Agent Platform — 10

  • FeatureControl user intent matching for semantic governance policies You can now turn user intent matching on or off for semantic governance policies by setting the sg…Mon 26 Oct
  • FeatureCloud Storage output support for Gemini image generation models Direct Cloud Storage output persistence is generally available (GA) for Gemini Nano Banana 2.1 (…Mon 26 Oct
  • FeatureGemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS are Generally Available (GA) Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS are available in General Avai…Mon 26 Oct
  • FeatureSemantic governance policies support more model providers Semantic governance policies now evaluate tool calls from agents that use models from providers other…Mon 26 Oct
  • FeatureGemini Robotics ER 2 (Preview) Gemini Robotics ER 2 ( gemini-robotics-er-2-preview ) is available in Preview . Gemini Robotics ER 2 is an embodied reasoning vis…Tue 27 Oct
  • FeaturexAI's Grok 4.7 is generally available Grok 4.7 is now generally available (GA) for production use on the global endpoint and the US multi-region endpoint.Tue 27 Oct
  • ChangeUse a single regional Agent Registry instance for Gemini Enterprise apps For Gemini Enterprise apps, we recommend associating each Agent Gateway with a single r…Wed 28 Oct
  • FixedCodeMender updates (v0.17.0) This release introduces updates to CodeMender: Support bundle diagnostics : Introduce cm support-bundle to collect environment meta…Wed 28 Oct
  • FeatureInference request metadata logging (GA) Inference request metadata logging is generally available. Gemini Enterprise Agent Platform can write one Cloud Logging…Fri 30 Oct
  • FeatureComputer use tool is available in General Availability The Computer use tool is available in General Availability (GA) . This release introduces comprehensive H…Fri 30 Oct

Google Cloud Armor — 1

  • FeatureCloud Armor supports advanced match conditions to include attributes for inspecting request body content and parameters. This lets you write custom CEL rules to…Tue 27 Oct

Google Cloud VMware Engine — 2

  • FeatureVMware solution on Google Cloud is generally available (GA). VMware solution lets you deploy, configure, and manage VMware Cloud Foundation (VCF) on dedicated b…Tue 27 Oct
  • FeatureVMware solution on Google Cloud is generally available (GA). VMware solution lets you deploy, configure, and manage VMware Cloud Foundation (VCF) on dedicated b…Tue 27 Oct

Google Distributed Cloud (software only) for bare metal — 2

  • FixedThe 1.34.1000-gke.111 release notes incorrectly omitted the following fix, which is fixed in 1.34.1000-gke.111: Fixed an issue where the Whereabouts IPAM garbag…Mon 26 Oct
  • AnnouncementThe release notes for the following versions incorrectly stated that a fix for an issue where Metrics API operation, like kubectl top , Horizontal Pod Autoscali…Tue 27 Oct

Google Kubernetes Engine — 14

  • Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Mon 26 Oct
  • FeatureThe C4D bare metal machine types ( c4d-standard-384-metal , c4d-highcpu-384-metal , and c4d-highmem-384-metal ) are generally available on GKE. You can create C…Mon 26 Oct
  • No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Mon 26 Oct
  • Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Mon 26 Oct
  • Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Mon 26 Oct
  • Security(2026-R45) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Mon 26 Oct
  • Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Mon 26 Oct
  • Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 27 Oct
  • No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 27 Oct
  • Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 27 Oct
  • Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 27 Oct
  • Security(2026-R46) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Tue 27 Oct
  • Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 27 Oct
  • FeatureManaged OpenTelemetry for GKE is generally available (GA) on clusters running GKE version 1.37.1-gke.1697000 or later. You can collect OpenTelemetry Protocol (O…Thu 29 Oct

Google SecOps Marketplace — 9

  • ChangeMicrosoft Graph Mail Delegated : Version 27.0 Fixed an issue where overflowed alerts were skipped without saving their IDs or marking the emails as read, preven…Wed 28 Oct
  • ChangeTools : Version 85.0 Fixed an issue where environment names containing ampersands ( & ) weren't properly filtered in the following action: Get Integration Insta…Wed 28 Oct
  • ChangeWiz : Version 11.0 Fixed inbound and outbound closure reason mappings between Wiz and Google SecOps in the following job: Wiz and Google SecOps Bi-directional S…Wed 28 Oct
  • ChangeMicrosoft Graph Mail : Version 50.0 Fixed an issue where overflowed alerts were skipped without saving their IDs or marking the emails as read, preventing infin…Wed 28 Oct
  • ChangeGoogle Chronicle : Version 99.0 Fixed an issue where the connector could stop ingesting alerts when composite detections failed to load or pagination did not pr…Wed 28 Oct
  • ChangeOkta : Version 19.0 Integration : Updated OAuth authentication scopes to support user management actions.Wed 28 Oct
  • ChangeMicrosoft 365 Defender : Version 34.0 Added the Time Frame , Start Time , and End Time parameters to support time-based query filtering in the following action:…Wed 28 Oct
  • FeatureSAP ERP : Version 1.0 New SAP ERP integration.Wed 28 Oct
  • FeatureGoogle Threat Intelligence : Version 23.0 The following new action has been added: Ask Threat Intelligence AgentWed 28 Oct

Identity and Access Management — 1

  • FeatureThe Admin ( roles/admin ), Writer ( roles/writer ), and Reader ( roles/reader ) basic roles are generally available ( GA ). For more information, see Basic role…Thu 29 Oct

Knowledge Catalog — 1

  • FeatureSupport for Looker (Google Cloud core) in Data lineage is now generally available . This support includes lineage views for LookML views and Explores, Looker da…Mon 26 Oct

Looker — 22

  • FeatureLooker (Google Cloud core) data lineage is now generally available (GA). The GA launch adds end-to-end visibility for LookML dashboards and Conversational Analy…Mon 26 Oct
  • FeatureThe Looker-managed Model Context Protocol (MCP) server is now generally available (GA), allowing AI agents to securely interact with business data and LookML mo…Mon 26 Oct
  • FeatureThe latest version of the Looker-Excel Connector ODBC driver, version 1.0.7, is now available to download. See the Looker-Excel Connector documentation page for…Tue 27 Oct
  • AnnouncementBeginning October 26, 2026, the following features will be automatically enabled for Looker (original) and Looker (Google Cloud core) instances running Looker 2…Thu 29 Oct
  • AnnouncementThe latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Rapid channel: Looker 26.22 La…Thu 29 Oct
  • BreakingSome elements of the Conversational Analytics System Activity dashboard have been renamed. The dashboard layout and capabilities remain the same. On the Token u…Thu 29 Oct
  • ChangeThe Use Legacy Connections Page legacy feature and the legacy database connection workflow have been removed. All database connections now use the connection wo…Thu 29 Oct
  • FeatureThe ability to generate a summary of an Explore by using Gemini assistance is now generally available.Thu 29 Oct
  • FeatureThe bullet chart visualization type is now generally available. Bullet charts let you evaluate a single primary metric's performance as one or more bars and mar…Thu 29 Oct
  • FeatureLooker now includes network diagnostics to help you troubleshoot database connectivity issues. When a database connection test fails, Looker automatically tests…Thu 29 Oct
  • FeatureThe Table Row Grouping feature and the Grouping menu options are now generally available. The Grouping menu options let you display and customize the appearance…Thu 29 Oct
  • FeatureThe Visualization Assistant is now generally available.Thu 29 Oct
  • FeatureLooker Continuous Integration (CI) now supports hub-and-spoke projects. If your Looker project uses local project imports to import files from an upstream hub p…Thu 29 Oct
  • FeatureTwo new legacy features, Use Legacy Explore and Merge Query Experience and Use Legacy Explore and Merge Query Experience for Embed , are now available for Looke…Thu 29 Oct
  • FeatureLooker now includes a new histogram chart visualization option. A histogram chart is a graphical representation of the data distribution of an attribute. A hist…Thu 29 Oct
  • FeatureThe KPI (Single Value) chart type is now generally available. The KPI (Single Value) chart type replaces the Single Value chart type.Thu 29 Oct
  • FeatureThe new Looker Explore and merge query experience is now generally available and is the default interface for Explores and for joining data from multiple querie…Thu 29 Oct
  • FeatureWhen you enter values in a string filter on dashboards, Looks, or Explores, clicking Done or clicking outside the input field no longer creates a filter chip fr…Thu 29 Oct
  • FeatureThe new Dashboard Tile Groups preview feature lets you organize related tiles into collapsible containers for improved visual organization. You can move, duplic…Thu 29 Oct
  • FeatureNow available in preview , the Release Changelog gives Looker users and administrators real-time visibility into the features, behavioral changes, and bug fixes…Thu 29 Oct
  • FeatureThe Legacy features page is now available in the Admin panel for Looker (Google Cloud core) instances. Legacy features that appear on the Looker (Google Cloud c…Thu 29 Oct
  • AnnouncementOn November 1, 2026, several Canadian provinces and territories—Manitoba, Alberta, British Columbia, and parts of the Northwest Territories—transition to perman…Fri 30 Oct

Media CDN — 2

  • FeatureMedia CDN supports flexible origin shielding in Frankfurt ( europe-west3 ). This feature is generally available (GA) . For more information, see Flexible shield…Wed 28 Oct
  • FeatureMedia CDN supports EU data residency in Private GA . This feature helps ensure that your content and end-user data are processed within the EU. To enable this f…Wed 28 Oct

Memorystore for Redis Cluster — 1

  • FeatureThe basic token-based authentication feature is Generally Available .Wed 28 Oct

Model Armor — 3

  • FeatureModel Armor enforces the constraints/modelarmor.managed.requireTemplateDataResidencyCompliance managed Organization Policy Service constraint by default. When y…Mon 26 Oct
  • FeatureYou can test Model Armor templates in the Google Cloud console by using custom sample prompts to verify which safety and security filters the prompts trigger an…Tue 27 Oct
  • FeatureModel Armor is available in Brazil ( southamerica-east1 ). This region provides data residency compliance for at-rest, in-use, and in-transit data with limited…Thu 29 Oct

Oracle Database@Google Cloud — 2

  • FeatureThe Oracle Database@Google Cloud remote MCP server is generally available (GA) and adds tools to create and manage Database Connections and run SQL statements w…Mon 26 Oct
  • FeatureFor Exadata Database Service, Oracle Database@Google Cloud is available in northamerica-south1 (Querétaro, Mexico) region. For a list of supported locations, se…Tue 27 Oct

SAP on Google Cloud — 2

  • AnnouncementABAP SDK for Google Cloud version 1.15 (On-premises or any cloud edition) Version 1.15 of the on-premises or any cloud edition of the ABAP SDK for Google Cloud…Thu 29 Oct
  • AnnouncementGoogle SecOps for SAP is generally available (GA) Google SecOps for SAP is generally available (GA). This solution helps you protect your enterprise SAP applica…Fri 30 Oct

Secure Source Manager — 1

  • FeatureYou can now enable vulnerability scanning to detect known vulnerabilities in your dependencies.Fri 30 Oct

Security bulletin — 2

  • GCP-2026-073Published: 2026-10-26 Description Description Severity Notes An incorrect authorization vulnerability was discovered in Compute Engine prior to August 31, 2026.…Mon 26 Oct
  • GCP-2026-074Published: 2026-10-28 Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Applica…Wed 28 Oct

Spanner — 2

  • FeatureSpanner supports the ON DELETE SET NULL foreign key action for GoogleSQL and PostgreSQL dialects. Use ON DELETE SET NULL when you delete a referenced row to set…Tue 27 Oct
  • FeatureSpanner supports equality and ordering comparisons on JSONB and JSON values. You can use these values in GROUP_BY and ORDER BY clauses without first converting…Fri 30 Oct

VPC Service Controls — 1

  • FeaturePreview stage support for the following integration: App Optimize APIThu 29 Oct
Looking for one service rather than a whole week?

Every AWS, Azure and Google Cloud announcement is browsable by service and date, each linked to the vendor’s own page — and the other weekly roundups are collected in one place.

Browse announcements →
Topics: GCP Weekly Intelligence GCP

Comments

How was your experience?
Your feedback helps improve this site.
PoorExcellent