GCP Newsletter #526

Welcome to issue #526 October 26th, 2026

News

Introducing Agent Compute Engine and expanded agent governance - The new Agent Compute Engine plus expanded Gemini for business agent governance deliver the control you need to run, govern, and scale your agents.

BigQuery ObjectRef now GA: Build multimodal data platforms for conversational analytics entirely in SQL - BigQuery ObjectRef is now GA. Combine unstructured data with Gemini to build powerful multimodal analytics and conversational agents using SQL.

Introducing new self-learning context enrichment in Knowledge Catalog - New self-learning enrichment in Knowledge Catalog keeps AI agent context current as definitions change, for more accurate, faster, lower-cost agents.

Introducing Gemini for government services - Gemini for government services, now in preview, gives agencies skills, connectors, and partner agents with governance built in.

Announcements and highlights from Google Public Sector Summit 2026 - Explore new announcements from the Google Public Sector Summit, including Gemini for government services and Wiz agents to accelerate your mission.

Announcing llm-d 1.0: Open distributed inference for agents on Google Cloud TPUs and GPUs - An open, Kubernetes-native serving stack with cache-aware routing, multi-tenant traffic control, tiered KV cache, and high availability ready for production on Google Kubernetes Engine.

TorchTPU is now open source: Run native PyTorch on TPUs - With TorchTPU now available as open source on GitHub, you can now train, serve, and deploy models on TPUs using the tools you already rely on.

Simulate, train, and operate robots with Google Cloud physical AI - Simulate, train, and operate robots with Google Cloud Physical AI. Pair NVIDIA GPUs, Isaac Sim, DeepMind MuJoCo, and Gemini on one platform.

Expanding Claude availability and deployment choice on Google Cloud - Today, we’re announcing the general availability of an Anthropic-managed deployment option for Claude Models on Google Cloud. This gives developers more choice in how they run their models, helping them consolidate AI workloads on Google Cloud by pairing direct access to Anthropic’s platform alongside our existing, in-boundary Google-managed deployment option.

Google Cloud expands model choice and flexibility, bringing OpenAI models to customers - Today, we are launching OpenAI models in Google Cloud’s model garden. Google Cloud is now the only hyperscale cloud provider offering access to Gemini, Claude, and GPT, alongside more than 200 first-party, third-party, and open models on a unified enterprise AI platform.

Claude Opus 5.5 and Claude Sonnet 5.5 are now available in Google Antigravity - In keeping with Google Cloud's commitment to an open ecosystem and to give developers the right model for every job, Claude Opus 5.5 and Claude Sonnet 5.5 are now available in Google Antigravity.

Google Cloud and NVIDIA expand co-engineering collaboration to scale infrastructure for the agentic era - In collaboration with NVIDIA we announced enhancements to AI Hypercomputer, plus new sovereign AI and Confidential Computing capabilities.

Hardware-backed security at global scale: Confidential G4 with NVIDIA Blackwell is GA - Now GA, Confidential Computing on G4 provides hardware-based security in AI Hypercomputer to deliver dynamic performance without compromising privacy.

Announcing New vLLM and SGLang Inference Engines on TPU - This post announces native PyTorch backends for vLLM and SGLang powered by TorchTPU, enabling developers to run and optimize serving workloads using familiar PyTorch tools. Built in collaboration with open-source project maintainers, these engines include optimized TPU kernel implementations, production-ready features like KV cache management with TPU Sync, and disaggregated serving. Public benchmarks demonstrate state-of-the-art performance and industry-leading cost efficiency on Ironwood TPU across long-context and agentic workloads.

Google named a Leader in the 2026 IDC MarketScape for Agentic AI Platforms - Gemini provides that connected foundation across your spectrum of employees and surfaces, and it’s why we believe Google was named a Leader in the inaugural IDC MarketScape: Worldwide Agentic AI Platforms 2026 Vendor Assessment.

Articles, Tutorials

Infrastructure, Networking, Security, Kubernetes

Enabling the next era of sovereign AI: The latest Google Distributed Cloud innovations - Google Cloud has announced major innovations for its Distributed Cloud (GDC) air-gapped solution, bringing advanced sovereign AI and enterprise search capabilities directly to highly regulated and isolated environments.

Managed RAG search inside the sovereign perimeter: Gemini on GDC enterprise search - Gemini enterprise search on Google Distributed Cloud (GDC) air-gapped runs entirely inside your physical security perimeter, to maintain sovereignty.

ZenteiQ scales batch inference 4x with GKE Inference Gateway powered by llm-d - ZenteiQ uses GKE Inference Gateway and llm-d to boost multi-model inference throughput 4x and keep foundation model pre-training runs on schedule.

Inside Agent Compute Engine: Building the compute foundation for the agentic era - Traditional compute primitives are not built to run hundreds of millions of these agents at planet scale, which led us to build Agent Compute Engine.

DRA Explained for Kueue Users-Part 4: Practical use case - This article is part of DRA Explained for Kueue Users series: Foundations, Time-slicing, MIG, Practical use case.

RDP to a Windows VM over IAP: serial port 4, NLA and a certificate you can’t check - This article explores the technical mechanics and security nuances of connecting to a Windows virtual machine on Google Cloud Platform using Remote Desktop Protocol over Identity-Aware Proxy. It breaks down how temporary credentials are securely retrieved via serial ports, the role of Network Level Authentication in establishing secure sessions, and how to troubleshoot common connection errors.

The C$71K Bill Arrived Overnight. Your Budget Alert Just Watched. - This article explains how cloud engineers can build an automated kill switch using Pub/Sub and Cloud Functions to disconnect billing accounts when spending thresholds are breached.

Architecting for 99.99%: Multi-Regional Disaster Recovery for GKE and Cloud AI Workloads - This article explores how to achieve a 99.99% multi-regional availability standard for mission-critical Google Kubernetes Engine (GKE) and Cloud AI workloads.

Kubernetes Ingress vs Gateway API on Google Cloud - This article provides a comprehensive comparison between the traditional Kubernetes Ingress and the modern Gateway API for exposing HTTP(S) workloads on Google Kubernetes Engine.

GKE Fleet Scopes: Unifying Multi-Cluster RBAC and Logging - Managing multi-cluster Kubernetes environments introduces significant operational complexity around synchronizing access controls and maintaining centralized observability. This article explores how Google Kubernetes Engine (GKE) Fleet Scopes eliminate this overhead by automating namespace provisioning, multi-cluster RBAC, and isolated cloud logging out of the box.

New to Google SecOps: Don’t Get Aggravated, It’s Just |> AGGREGATE - This article explores how to use the AGGREGATE pipe operator in Google Security Operations (SecOps) to perform statistical analysis and group events using SQL pipe syntax.

App Development, Serverless, Databases, DevOps

Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 - Follow these recommendations to minimize remote code execution risks in PHP from two critical vulnerabilities in the core PHP language runtime.

Developer’s guide to implementing MCP apps in Gemini - Learn how to implement MCP Apps in Gemini.

Streaming comes to API Gateway: real-time and AI-ready APIs, without changing your spec - API Gateway now supports real-time streaming—including Server-Sent Events, WebSockets, gRPC, and chunked transfer encoding—in Public Preview without requiring changes to your existing API specifications.

Dynamic MCP Server Discovery on Google Cloud - Your agents shouldn’t know where MCP servers run. Find them at runtime with Google Cloud Agent Registry, ADK and semantic search.

Spanner Deployment Explorer: Taking the guesswork out of the Spanner instance configuration selection - Narrowing down your target topology with Gemini, interactive maps and live latency benchmarks.

Active-Active Without Split-Brain - Multi-region transactions with Spanner and global load balancing.

Your Agent’s Context Window Is Not a Vault - Five Secret Manager patterns for agentic Python apps on Google Cloud: keep API keys out of prompts, tool results, logs and traces.

Big Data, Analytics, ML&AI

Building full virtual vehicles on Google Cloud: From AAOS to the smallest MCU - Meet Horizon, an agentic innovation platform for developing software-defined vehicles to help manufacturers avoid inefficiencies through partners like RemotiveLabs.

How to Use Python UDF Logging for Pipeline Observability - Ensure data pipeline reliability and troubleshoot issues fast by using standard Python logging directly in BigQuery UDFs for real-time observability.

Don’t mock BigQuery, test on BigQuery: the rewrite of BigTesty - This article introduces BigTesty 1.x, an open-source testing tool designed to test Google Cloud BigQuery SQL and infrastructure directly on the real engine rather than using unreliable mocks or shared datasets.

Handling Late-Arriving Data in Google Cloud Dataflow: A Production Architecture for 100% Eventual Data Correctness - How event time, watermarks, allowed lateness, deduplication, BigQuery, reconciliation, and replay work together to prevent silent data loss.

Who judges the judge? Three helpful ways to audit your LLM evaluators - In this post, we’ll explore what’s holding enterprises back from strong evals, and an easy three-pillar method to improve your quality.

Architecting Governed, Self-Evolving AI Agents on Google Cloud - Learn how Project Chrysalis combines Google Cloud's Gemini Enterprise Agent Platform, Agent Development Kit (ADK), BigQuery, and a four-gate defense-in-depth security stack (Model Armor, Cloud KMS, Binary Authorization, and OPA) to build governed, self-evolving AI agents that remediate live production outages in 1.8 seconds.

How to prompt open LLM models across massive datasets - Query Gemma, Llama, Mistral, and Hugging Face models directly from BigQuery SQL with zero data movement.

How to manage costs when prompting open source LLMs from BigQuery - A practical guide to keeping your cloud budget under control when running open LLMs in BigQuery.

From Cloud Storage to Structured Data: Building an AI-Native ELT Pipeline in BigQuery - This article explores how to build an AI-native ELT pipeline in Google Cloud by combining Cloud Storage and BigQuery's generative AI functions to transform unstructured documents into queryable data. It details how tools like object discovery and multimodal inference allow data engineers to extract structured schemas directly through SQL without relying on complex, separate parsing infrastructure.

Getting Started with the Google Cloud CLI Remote MCP Server - A practical, step-by-step guide to running gcloud and bq commands from AI agents, across curl, Local IDEs, Google ADK, and Managed Agents.

Google Cloud CLI Remote MCP Server (Part 2): Building a Multi-Node ADK Workflow for Cloud Audit & Live Remediation - This article explores how to combine the Google Cloud CLI Remote MCP Server with the Google Agent Development Kit (ADK) to build an automated, multi-node cloud audit and remediation workflow.

Step by Step guide: Build a Voice Agent That Never Goes Silent using ADK - The open-source Agent Development Kit (ADK) and gemini-3.8-live enable developers to build responsive voice agents by implementing non-blocking tools in Python. Developers can use streaming tools to yield progress updates or background execution patterns to keep conversations fluid during long-running backend queries. Additionally, configuring response scheduling behaviors such as WHEN_IDLE, INTERRUPT, or SILENT gives developers precise control over when and how tool results are delivered into the conversation.

Powering the Agent Development Lifecycle with any framework, from ADK to LangChain and beyond - The Agents CLI Extension System enables developers to use frameworks like LangChain, LangGraph, or custom enterprise stacks while retaining a unified deployment and evaluation workflow. It details a first-party LangChain template that scaffolds, runs, and deploys agents without requiring the Agent Development Kit (ADK). Additionally, it demonstrates how platform teams can author custom extensions to enforce policies such as automated software bill of materials (SBOM) scans during deployment.

Integrating TorchTPU into TorchTitan and Optimizing Models for TPU - TorchTPU integrates a native torch.device("tpu") backend directly into PyTorch, allowing developers to train large-scale models on Google Cloud TPUs without rewriting code in JAX. The TorchTitan TPU fork enhances this with production-grade scaling primitives like SimpleFSDP, Graph Trainer, and custom Pallas kernels that achieve high Model Flops Utilization (MFU) across dense and MoE architectures. Developers can leverage these battle-tested optimization playbooks, recipes, and the Hugging Face modeling backend to efficiently scale their own workloads on TPU infrastructure.

Various

Google Public Sector increases partner investments for frontline adoption - Discover how Google Public Sector is increasing partner investments to accelerate frontline adoption and help organizations drive modernization.

Slides, Videos, Audio

GCP Bytes Podcast - #52 In this episode we discuss; Roadster, Yandex Dcs RSI, Drone Racing, GTA6, AnyPS5, Macbook Neo, GDG, HyperArmor, Crypto Crack, Gemini Agent, U4 Ultra Low Latency, Fidge Hack, Deepseek 4,.1 Flash, MS Maia 300 Chip, Muse Model, Stop Being Mean To Claude, Anthropic Hiring Practices, Reverse Engineer Anything.

Releases

AlloyDB - Lakehouse federation in AlloyDB is generally available ( GA ). This feature lets you query live data in BigQuery directly from AlloyDB using the bigquery_fdw extension without moving or duplicating the data. For more information, see Access to real-time data in BigQuery overview and Configure access to real-time data in BigQuery.

AlloyDB Omni - Release highlights (full notes at the link): The AlloyDB Omni web user interface is generally available for version 18.1.0 and later, providing a centralized dashboard for cluster management. The new interface enables users to monitor high availability, system resources, query performance, columnar engine metrics, and database parameters. Additionally, it supports tracking AI and ML capabilities, including vector search health and connectivity to remote endpoints like Vertex AI.

Apigee Hybrid - Release highlights (full notes at the link): Apigee hybrid v1.15.9 includes security patches addressing multiple vulnerabilities across ingress, Istiod, runtime, and telemetry components. The update updates the apigee-redis container to the Valkey engine version 8.1.10 while preserving binary names and the RESP2 wire protocol. It also resolves functional issues, including fixing JWKS cache expiration behavior for VerifyJWT policies, correcting RegularExpressionProtection pattern matching, and ensuring proper HTTP status codes for Extension Processor denials.

AppEngine Standard Go - The following runtime language contains important security updates: Go 1.24 and later: 1.24.13, 1.25.14, 1.26.10, 1.27.3 The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

AppEngine Standard JAVA Second Generation - The following runtime language contains important security updates: Java 17 and later: 17.0.20_101, 21.0.12_101.0.LTS, 25.0.5_8.0.LTS The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

AppEngine Standard NodeJS - The following runtime language contains important security updates: Node.js 22 and later: 22.23.4, 24.22.1, 26.12.1 The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

AppEngine Standard PHP Second Generation - This note is incorrect; follow guidance in the entry for October 22, 2026. Patch updates to supported PHP runtimes are available with deployments from source: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP workloads have automatically been patched. See Responding to core PHP vulnerabilities for more information. All supported versions of PHP 8.2 and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See Responding to core PHP vulnerabilities for more information. The following runtime language contains important security updates: PHP 8.2 and later: 8.2.35, 8.3.36, 8.4.27, 8.5.12 The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

AppEngine Standard Ruby - The following runtime language contains important security updates: Ruby 3.3 and later: 3.3.12, 3.4.11, 4.0.7 The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

BigQuery - The AI.CHUNK_DOCUMENT function is a table-valued function that splits unstructured documents into semantically coherent text chunks optimized for vector embeddings and Retrieval-Augmented Generation (RAG) workflows. This function is generally available (GA). The AI.TRANSLATE function lets you translate text strings between languages. AI.TRANSLATE supports standard Neural Machine Translation (NMT) workloads and Translation LLM (TLLM) capabilities. This function is generally available (GA).

Billing - SKU attributes and granular usage units in pricing data export (Preview) SKU attributes and granular usage units are now available in Preview in the Cloud Billing pricing data export to BigQuery. SKU attributes: SKU attributes are key-value pairs that describe the SKU. For example, Key: model_name, Value: gemini_2_5_flash. Granular usage units: Granular usage units are the usage unit of the SKU, such as tokens. For more information about these dimensions, see the following: SKU attributes Granular usage units

Buildpacks - Patch updates to PHP runtimes are available on google-22 and google-24 tags: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Take immediate action to protect your PHP workloads by rebuilding your workloads with updated dependencies. See Responding to core PHP vulnerabilities for more information. The following runtime languages contain important security updates: Go 1.24 and later: 1.24.13, 1.25.14, 1.26.10, 1.27.3 Node.js 22 and later: 22.23.4, 24.22.1, 26.12.1 Java 17 and later: 17.0.20_101, 21.0.12_101.0.LTS, 25.0.5_8.0.LTS PHP 8.2 and later: 8.2.35, 8.3.36, 8.4.27, 8.5.12 Python 3.10 and later: 3.10.22, 3.11.17, 3.12.15, 3.13.15, 3.14.6 Ruby 3.3 and later: 3.3.12, 3.4.11, 4.0.7.NET 6 and later: 6.0.428, 8.0.415, 10.0.100 The following stacks and their underlying operating system packages have also been updated: google-22, google-22-full google-24, google-24-full Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See Security bulletins for Google Cloud for more information.

CX Agent Studio - Composite V2 model ( gemini-composite-v2 ) is now generally available for enterprise voice agents, with more natural speech and inline tags for precise delivery control. For guidance, see Best practices for composite models. AI Co-Builder: Arc acts as an intelligent, always-on agent building partner, bringing autonomous assistance to every stage of agent design, development, evaluation, diagnosis, and optimization.

Chronicle SOAR - Release 6.3.103 is now available for all regions. Release 6.3.104 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.

Chronicle Security Operations - Bulk case selection In the enhanced Investigation Management experience, you can select up to 50 cases at a time in the case queue to perform bulk operations: Range selection: Hold Shift while clicking to select a range of cases. Select all: Click the header checkbox to select up to 50 loaded cases; this action automatically scrolls your view back to the top of the list. Resize inline images in Case Wall comments You can now resize inline images directly in rich-text comments on the Case Wall. To resize an image, switch the comment box to rich-text mode and insert an image either by using the toolbar's image menu or by pasting it into the comment. Click the image to display the resizing overlay, then drag the bottom-right handle to adjust its dimensions.

Cloud Architecture Center - Single-agent AI system using ADK and Cloud Run: Updated to include Model Armor in the architecture. Build trusted AI agents with Google Maps Platform: Added security guidance for governing AI agents and tools by using Agent Identity, Agent Gateway, Agent Registry, and Model Armor.

Cloud Asset Inventory - The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search ( SearchAllResources, SearchAllIamPolicies ) APIs. Fault Injection Testing faulttesting.googleapis.com/Experiment faulttesting.googleapis.com/ExperimentTemplate faulttesting.googleapis.com/Validation Firebase Storage firebasestorage.googleapis.com/Bucket firebasestorage.googleapis.com/DefaultBucket Privileged Access Manager privilegedaccessmanager.googleapis.com/Entitlement

Cloud Firestore - Text search and Geospatial search are generally available ( GA ). Data modification language (DML) operations are generally available ( GA ). Added support for insert and upsert.

Cloud Functions - Release highlights (full notes at the link): Important security patch updates are now available for supported Go, Node.js, Java, PHP, Python, Ruby, and .NET language runtimes. The underlying operating system packages for the google-22 and google-24 stacks have also received security updates. Users with automatic base image updates disabled must redeploy their workloads and rebuild resources with updated dependencies to apply these patches.

Cloud Monitoring - Ops Agent version 2.73.0 includes patches for a Go vulnerability involving system root certificates, CVE-2026-111943. For more information, see Ops Agent 2.73.0 notes.

Cloud Run - Release highlights (full notes at the link): Cloud Run now offers a preview of Direct VPC ingress, allowing instances to use ephemeral private IP addresses for internal VPC communication. Critical security patch updates are available for multiple runtime languages, including Go, Node.js, Java, PHP, Python, Ruby, and .NET. Users must rebuild and redeploy affected Cloud Run and buildpack resources to apply these mandatory dependency updates.

Cloud SQL Postgres - In response to GCP-2026-071, Google is updating Cloud SQL's managed components. No manual updates to the certificate store are required for Cloud SQL-managed instances. The fix is shipping in a new maintenance version that will be applied during scheduled maintenance. You can also apply the fix by performing self-service maintenance. An announcement will be published when the self-service maintenance fix is available. What should I do? If you use the Cloud SQL Auth Proxy, then upgrade the Cloud SQL Auth Proxy to 2.26.3 or later and the Cloud SQL Proxy Operator to 1.8.4 or later. If you run the standalone proxy binary, then also update the host's certificate authority (CA) certificates. If you use a Cloud SQL Language Connector, then update the language runtime and operating system CA certificates used with the Cloud SQL Language Connector (for example, Go 1.26.10 or 1.27.3 or later, certifi 2026.10.19 or later). If you're using the gcloud CLI to install the Cloud SQL Auth Proxy, then update the gcloud CLI to 590.0.1.

Cloud Spanner - Spanner supports approximate aggregate functions for both GoogleSQL and PostgreSQL dialects. These functions produce statistical estimates of distinct counts, allowing you to compute results faster and save resources on large datasets compared to exact aggregation. For more information, see approximate aggregate functions ( GoogleSQL and PostgreSQL ), HyperLogLog++ functions, and Sketches.

Cloud Tasks - Cloud Tasks is available in the following locations: asia-south2 (Delhi, India) northamerica-northeast2 (Toronto, Canada)

Cluster Director - Generally available: You can use the C4A machine series for login nodes in clusters that use the A4X Max or A4X machine series for compute nodes. This configuration provides a consistent Arm-based architecture across compute and login nodes in your cluster. For more information, see C4A machine series.

Compute Engine - Generally available: To prevent data loss or corruption when you stop or delete a Compute Engine instance, you can enable graceful shutdown. This setting gives the guest OS up to six hours to finish running tasks. For more information, see About graceful shutdown. You can view how a managed instance group (MIG) distributes its instances across zones and machine types, directly from the MIG's Monitoring tab in the Google Cloud console. For more information, see Monitor instance distribution in MIGs. Generally available: Resource-based committed use discounts (CUDs) are available for block storage resources like Google Cloud Hyperdisk Balanced and Google Cloud Hyperdisk Throughput Exapool capacity. You can purchase 1-year and 3-year block storage commitments for Hyperdisk Balanced and Hyperdisk Throughput Exapool capacity and receive discounted rates for the capacity units that you consume as part of applicable Google Cloud Hyperdisk Exapools. For more information, see Block storage commitments and Purchase block storage commitments for Exapools.

Confidential Space - A new Confidential Space image (261000) is available.

Contact Center AI Platform - Release highlights (full notes at the link): Google Cloud CCaaS version 6.22 introduces per-segment transcript separation for chats, enabling individual files for each participant. In version 6.26, scheduled callbacks are available as an IVR overcapacity deflection option, and Salesforce integration adds support for PKCE and refresh token rotation. Both new capabilities are inactive by default and require activation by Google Cloud Support.

Data Studio - You can connect Data Studio to a BigQuery Graph or query a graph by using a custom SQL query in the BigQuery connector, which imports graph measures as metrics that you can use in your reports. For more information, see Connect to Google BigQuery.

Dataflow - Dataflow now supports streaming high availability for Streaming Engine jobs ( Preview ). When you enable the requires_high_availability service option, Dataflow replicates backend state across multiple zones in a region to protect your job from single-zone failures. For more information, see Streaming high availability.

Dialogflow - Dialogflow CX: You can set the telephony_disable_voice_processing session parameter to true to turn off speech recognition and accept only DTMF input for the rest of the session. This helps in noisy environments, where speech recognition can transcribe background noise as end-user input. See Turn off speech recognition for telephony.

Firestore with MongoDB compatibility - Text search and Geospatial search are generally available ( GA ).

GKE new features - You can now provision GKE nodes from storage-optimized Z4M machine series: Manually: starting from GKE version 1.36.3-gke.1767000 and later. Using compute classes, cluster autoscaler, node pool auto-creation and in Autopilot clusters: starting from GKE version 1.37.0-gke.4713000 and later. Z4M machine series are suited for large parallel file systems to support AI/ML workloads and for I/O intensive workloads such as databases. GKE does not support Z4M bare metal instances at this time. See Machine support with GKE.

Gemini Enterprise - Release highlights (full notes at the link): Gemini Enterprise now generally offers the Antigravity Enterprise Gateway for centralized traffic routing and security enforcement, alongside new generally available single-user quota limits to manage shared subscription pools. Additionally, Gemini 2.5 Pro has been discontinued for in-country app deployments in Canada and Japan with automatic fallback to Gemini 3.5 Flash, and Gemini 4 Argon is scheduled to become the default model for new AlphaEvolve experiments on October 26, 2026.

Gemini Enterprise Agent Platform - CodeMender updates (v0.16.0) This release introduces updates to CodeMender: Deep scan by default ( cm find ): cm find now runs a concurrent file-by-file deep scan ( --deep ) by default for higher vulnerability recall across repositories. To run a single-session quick scan instead, pass the --quick flag ( cm find --quick ). cm stats now breaks down scan usage by mode ( --deep, --quick, and --diff ). Pre-flight health checks ( cm health ): Added the cm health command (with --json, --strict, and --timeout flags) to verify credentials, configuration, endpoint reachability, and project authorization before running scans. Expanded file discovery: cm find now scans.hh,.hxx,.inl, and.ipp C++ headers, extensionless scripts with supported language shebangs ( python, node, ruby, and php ), nested build/, target/, obj/, and bin/ source directories, and production code under spec/, locale/, and i18n/. Bug fixes: Restricted cm verify file writes to.exploit/ inside the project root and skipped missing or out-of-scope session artifacts during workspace restore. Capped single-turn file reads at 256 KiB with pagination hints, bounded unified diff generation on large files, and raised run_command default and maximum timeouts to 120 seconds and 300 seconds. Fixed an issue where sandboxed sessions could not write tool call entries to ~/.codemender/audit.log. Updated multi-file --deep and --diff scans to report INCOMPLETE status when one or more file scans fail. For more information, see the CodeMender documentation.

Google Cloud Armor - Security fixes and enhancements to Cloud Armor preconfigured WAF stable rulesets for v3.0. For more information, see Tuning Google Cloud Armor WAF rules. The following rulesets have been updated: sqli-stable xss-stable lfi-stable rfi-stable rce-stable methodenforcement-stable scannerdetection-stable protocolattack-stable php-stable sessionfixation-stable Security fixes and enhancements to Cloud Armor preconfigured WAF v33-stable rulesets. For more information, see Tuning Google Cloud Armor WAF rules. The following rulesets have been updated: sqli-v33-stable xss-v33-stable lfi-v33-stable rfi-v33-stable rce-v33-stable methodenforcement-v33-stable scannerdetection-v33-stable protocolattack-v33-stable php-v33-stable sessionfixation-v33-stable java-v33-stable nodejs-v33-stable

Google Distributed Cloud (software only) for VMware - Release highlights (full notes at the link): Google Distributed Cloud for VMware versions 1.36.200-gke.118 and 1.34.1000-gke.111 are now available for download, running on Kubernetes v1.36.4-gke.100 and v1.34.7-gke.200 respectively. Both releases include security vulnerability fixes. Version 1.34.1000-gke.111 also resolves an issue that prevented control plane nodes from joining when updating or upgrading to an advanced cluster after certificate authority rotation.

Google Distributed Cloud for bare metal - Release highlights (full notes at the link): Google Distributed Cloud for bare metal versions 1.36.200-gke.118 and 1.34.1000-gke.111 are now available for download. These releases reduce API server connection failover time to approximately four seconds during control plane upgrades in clusters using bundled BGP load balancing. Additionally, they fix an issue where node drain in maintenance mode failed to wait for attached storage volumes to detach.

Kf - Upgraded Go compiler to 1.26.10 to resolve security vulnerabilities ( CVE-2026-111943 ). Updated the kf-thirdparty base image to gcr.io/distroless/static:latest to resolve OS package vulnerabilities ( CVE-2026-84782 ). Upgraded Go module dependencies ( google.golang.org/grpc to v1.79.3, go.opentelemetry.io/otel/sdk to v1.40.0, and knative.dev/pkg ) to resolve security vulnerabilities. Upgraded Tekton Pipelines dependency to v1.15.3.

Looker - Release highlights (full notes at the link): Automated cataloging and ingestion of Looker (Google Cloud core) metadata with Knowledge Catalog is now generally available, with data lineage remaining in preview. Table row group subtotals now display only for sum and count measures, leaving other measure types blank to prevent inaccurate values. Several stability and bug fixes address UI rendering issues, SDK method handling for optional parameters, and unnecessary derived table rebuilds during LookML model configuration.

Model Armor - You can use custom organization policies to ensure that all new or updated Model Armor Template resources enforce required filters, like responsible AI or prompt injection and jailbreak detection. This feature is generally available ( GA ). For more information, see Use custom organization policies.

Security Command Center - You can view issues created by Correlated Threats and security graph rules at the folder or project level. On the Issues page, you can filter all issues by service type, project number, and folder ID. For more information, see Issues overview. This feature is in Preview.

Virtual Private Cloud - General Availability: VPC Flow Logs adds the following metadata annotations and packet drop reasons for Cloud NAT: Metadata annotations: connection.nat_ip, connection.nat_port, and nat_gateway_details Drop reasons: NAT_ENDPOINT_INDEPENDENT_CONFLICT, NAT_OUT_OF_CONNECTIONS, and NAT_OUT_OF_PORTS For more information, see Record format and Packet drop reasons.

Workstation - Cloud Workstations supports automatic failover for boost configurations in Preview. When you enable automatic failover, Cloud Workstations automatically provisions a workstation VM using the boost configuration if Compute Engine lacks capacity for the default machine type during startup.