cloud
Google Cloud: security advisories, deprecations and releases
Google Cloud Platform, Google's public cloud.
- Items, 90 days
- 93
- Critical
- 0
- Last critical
- none
- This week
- 8
What your digest would have held this week
8 items from the last 7 days. Zero sends only the ones that touch your stack.
- HIGH GKE Private Service Connect API timeouts from three-layer networking bugs
- HIGH Updated Container-Optimized OS images fix vulnerabilities in GKE
- HIGH Cloud DNS changes CNAME chasing behavior January 5 2027
- HIGH GKE Container-Optimized OS security updates
- MEDIUM Upgrade log bucket to Observability Analytics for Flow Analyzer
- INFO Beyond Migration: Using Database Migration Service for disk shrinking
- INFO IAM Helper introduces agent-facing skills for automated IAM workflows
- INFO Bigtable adds microsecond timestamp granularity for high-frequency data
Security 13
- HIGH NEW THIS WEEK Google Cloud Blog · 30 Oct 2026
GKE Private Service Connect API timeouts from three-layer networking bugs
GKE clusters using Private Service Connect in europe-west experienced intermittent API server timeouts caused by packet reordering, Envoy half-close behavior, and a Linux kernel TCP bug in FIN_WAIT_2 state handling.
- HIGH NEW THIS WEEK GKE release notes · 28 Oct 2026
Updated Container-Optimized OS images fix vulnerabilities in GKE
New GKE versions include updated COS images with cumulative security fixes.
- HIGH NEW THIS WEEK GKE release notes · 27 Oct 2026
GKE Container-Optimized OS security updates
Updated COS images in multiple GKE versions fix cumulative security issues. Check release notes per version.
- HIGH Google Cloud release notes · 25 Oct 2026
Google Cloud App Engine flexible .NET security update
App Engine flexible environment updates .NET 6, 8, 10 and OS packages on google-22/24 stacks to fix security issues.
- HIGH ACT BY 23 OCT 2026 GKE security bulletins · 24 Oct 2026
GCP-2026-071: emSign CA compromise in GKE
Multiple emSign subordinate CA keys were stolen, exposing external TLS connections from GKE nodes and control plane to MitM. Internal cluster mTLS is safe. Patched GKE versions now distrust the bad CAs.
CVE-2026-111943 - MEDIUM ACT BY 20 OCT 2026 GKE release notes · 20 Oct 2026
GKE Cloud Storage FUSE CSI driver issue resolved
Resolved Cloud Storage FUSE CSI driver bug for ubuntu_containerd and older cos_containerd node pools in GKE.
- MEDIUM Cloudanix Threat Intelligence · 15 Oct 2026
Phishing Infrastructure Ecosystem (Storm-3119, Storm-2990)
Microsoft uncovered a Chinese-language cybercriminal ecosystem centered around the YAM Store (Storm-3119), an initial access broker selling compromised Microsoft and Google cloud environments. This infrastructure is used by phishing kit developers tracked as Storm-2990, who create and sell Phishing-as-a-Service (PaaS) products like CoGUI, Haozi, and Iron Man System. These kits facilitate large-scale phishing campaigns via email and SMS, targeting credentials…
- HIGH GKE release notes · 14 Oct 2026
GKE Sandbox Pods stuck in Terminating with Cloud Storage FUSE CSI driver
Pods using Cloud Storage FUSE CSI driver in GKE Sandbox may remain stuck in Terminating state indefinitely.
- HIGH GKE release notes · 9 Oct 2026
GKE security updates via new COS images
Updated Container-Optimized OS images bring cumulative security fixes for GKE versions 1.31-1.38; see COS release notes for specific CVEs.
- HIGH ACT BY 2 OCT 2026 GKE release notes · 3 Oct 2026
GKE 1.36.3+ FUSE CSI DaemonSet crash on older kernels
Control planes 1.36.3-gke.1244000 and later break the gcsfusecsi-node DaemonSet on Ubuntu and older COS node pools because /proc/sys/fs/fuse is absent.
- HIGH tl;dr sec · 3 Oct 2026
Breaking into Google's GFile for $100k
Researcher chained unauthenticated APIs and GFile path prefix bugs to access Colossus, Chubby and every engineer's LDAP hash.
- HIGH ACT BY 22 DEC 2026 GKE release notes · 3 Oct 2026
GKE nodes: updated Container-Optimized OS images fix security issues
Multiple GKE versions ship refreshed COS images containing the latest security patches from upstream COS releases.
- HIGH Google Cloud release notes · 2 Oct 2026
App Engine blocks TLS 1.1 and earlier on all runtimes
App Engine permanently blocks insecure TLS 1.1 and earlier traffic for both standard and flexible environments across all supported languages.
Deprecations 6
- HIGH NEW THIS WEEK ACT BY 5 JAN 2027 Google Cloud release notes · 27 Oct 2026
Cloud DNS changes CNAME chasing behavior January 5 2027
CNAME chains will now follow full VPC resolution order, possibly returning unintended internal IPs or NXDOMAIN.
- INFO Google Cloud Blog · 9 Oct 2026
BigQuery Storage Write API (REST) replaces legacy insertAll
The insertAll streaming API is rebranded as BigQuery Storage Write API (REST); no code changes are required, but gRPC remains the high-throughput recommendation.
- HIGH ACT BY 1 JUL 2026 GKE release notes · 6 Oct 2026
Identity Service for GKE deprecated in GKE 1.36 and earlier
Identity Service for GKE will be removed from GKE 1.36 and earlier starting July 1, 2026, and is unavailable for orgs created after July 1, 2025. GKE 1.37+ will not support it.
- HIGH ACT BY 15 SEPT 2026 Google Cloud release notes · 2 Oct 2026
NVIDIA P100 GPUs end of support
NVIDIA P100 GPUs reached end of support on September 15, 2026 and can no longer be created, launched, or accessed; migrate to G2 or G4 series.
- HIGH ACT BY 28 SEPT 2026 Google Cloud release notes · 2 Oct 2026
Legacy Monitoring agent end of support
Legacy Monitoring agent reached end of support; no more maintenance or bug fixes.
- MEDIUM Google Cloud release notes · 2 Oct 2026
Compute Engine 2026-10-01-preview removes quotas field
Preview version 2026-10-01 removes the quotas field from projects.get, regions.get, and regions.list responses.
Releases 50
Newest 50 of 61 in the last 90 days.
- INFO NEW THIS WEEK Google Cloud release notes · 28 Oct 2026
Bigtable adds microsecond timestamp granularity for high-frequency data
Bigtable now supports microsecond-precision cell timestamps, preventing write collisions in high-event-rate workloads. This is generally available for Enterprise Plus instances.
- INFO Google Cloud release notes · 22 Oct 2026
View MIG instance distribution in Compute Engine console
Managed instance groups now show zone and machine type distribution directly in the Monitoring tab.
- INFO Google Cloud release notes · 19 Oct 2026
Compute Engine graceful shutdown generally available
Graceful shutdown now generally available, giving guest OS up to six hours to finish tasks before stopping or deleting instances.
- INFO GKE release notes · 17 Oct 2026
GKE node upgrades now reuse existing Compute Engine VM
GKE Standard CPU node pools can now upgrade nodes in place by updating the existing VM instead of deleting and recreating it, preserving compute capacity during upgrades.
- INFO Google Cloud Blog · 15 Oct 2026
BigQuery adds Apache Iceberg V3 support
Native support for binary deletion vectors and sort orders improves row-level updates and deletes on Iceberg tables.
- INFO Google Cloud release notes · 15 Oct 2026
Compute Engine regional disk clones in preview
You can now create regional disks by cloning a zonal boot disk, including Hyperdisk Balanced HA volumes.
- INFO Google Cloud release notes · 13 Oct 2026
BigQuery AI.AGG function GA
The AI.AGG function is generally available. It aggregates unstructured data using natural language instructions.
- LOW Google Cloud release notes · 12 Oct 2026
Google Cloud Agent Platform Workbench 20261011-2230-rc0
Updated upstream packages and fixed AttributeError in gcloud/gsutil caused by pyOpenSSL vs cryptography version mismatch.
- MEDIUM Google Cloud Blog · 9 Oct 2026
Dataflow pause-on-failure generally available
Batch pipelines can be paused before failure, preserving state so operators can fix external issues and resume without data loss or reprocessing.
- MEDIUM Google Cloud Blog · 9 Oct 2026
BigQuery Graph in preview
Native graph analytics in BigQuery lets teams model, query and visualize massive-scale relationships directly on existing tables.
- INFO Google Cloud Blog · 9 Oct 2026
BigQuery identity columns generally available
Identity columns auto-generate sequential surrogate keys, removing the need for separate key-generation jobs in ETL pipelines.
- MEDIUM Google Cloud Blog · 9 Oct 2026
BigQuery augmented analytics TVFs and TabFM in preview
Six new table-valued functions plus TabFM foundation-model inference bring automated diagnostics and predictive ML directly into BigQuery SQL.
- HIGH Google Cloud Blog · 9 Oct 2026
Firestore Enterprise adds pipeline operations and 100+ query features
New query engine brings index-less queries, richer indexes and observability without leaving Firestore's serverless model.
- INFO Google Cloud Blog · 9 Oct 2026
Flexible column names for Iceberg tables generally available
Iceberg tables in BigQuery now accept spaces, hyphens and Unicode in column names without extra configuration.
- HIGH Google Cloud Blog · 9 Oct 2026
Dataflow adds Pause/Resume and Blackwell GPU support
Streaming and batch pipelines can now be paused and resumed; NVIDIA RTX PRO 6000 Blackwell GPUs are supported for large-scale AI workloads.
- MEDIUM Google Cloud Blog · 9 Oct 2026
Conversational Analytics generally available in BigQuery
Natural-language agent inside BigQuery Studio generates, runs and visualizes queries grounded in business context without leaving the console.
- MEDIUM Google Cloud Blog · 9 Oct 2026
Pub/Sub AI Inference SMTs generally available
Serverless message transform now runs Gemini Enterprise Agent Platform inference on each Pub/Sub event, appending predictions for downstream systems.
- HIGH Google Cloud Blog · 9 Oct 2026
AlloyDB adds PostgreSQL for agents and native BM25 search
AlloyDB now ships an agentic architecture with workload isolation and native BM25 keyword-plus-vector search, removing the need for a separate search engine.
- MEDIUM Google Cloud Blog · 9 Oct 2026
Microsoft Entra ID integration with Cloud SQL for SQL Server in preview
Cloud SQL now supports Entra ID (Azure AD) authentication and group mapping for SQL Server 2022, simplifying multi-cloud identity governance.
- INFO Google Cloud release notes · 8 Oct 2026
BigQuery Gemini assistance in SQL editor generally available
BigQuery Studio now includes an inline Gemini button to help write SQL when text is selected.
- MEDIUM GKE release notes · 7 Oct 2026
GKE 1.36 changes kube-dns default to CoreDNS, alters pod IP DNS behavior
GKE 1.36 switches kube-dns to CoreDNS. Pod IP queries with non-existent namespaces now return NXDOMAIN instead of skipping namespace checks.
- INFO Google Cloud release notes · 3 Oct 2026
VPA and HPA can jointly right-size CPU requests
Vertical Pod Autoscaler can now optimize CPU requests for workloads that also use Horizontal Pod Autoscaler on GKE 1.36.3+.
- INFO Google Cloud Blog · 3 Oct 2026
GKE CPU startup boost in preview
GKE now offers CPU startup boost via Vertical Pod Autoscaler. It temporarily raises CPU for faster pod initialization then scales back automatically without restarts.
- INFO Google Cloud Blog · 3 Oct 2026
Dataflow pipeline updates now support stop-and-replace
Generally available feature adds parallel pipeline updates and drain timeouts to reduce migration disruption.
- INFO Google Cloud Blog · 3 Oct 2026
Import Delta Lake tables with Dataflow Job Builder
Dataflow Job Builder now supports no-code import of Delta Lake tables stored in Cloud Storage.
- INFO ACT BY 16 JUN 2026 Google Cloud Blog · 3 Oct 2026
Resource-Based CUD Sharing enabled by default June 16, 2026
New billing accounts automatically share committed use discounts across projects to maximize savings.
- INFO Google Cloud Blog · 3 Oct 2026
Automate VM guest software lifecycle with VM Extension Manager, now GA
VM Extension Manager provides declarative, project-wide policies for managing guest OS extensions across Compute Engine fleets.
- INFO Google Cloud Blog · 3 Oct 2026
Stateful processing available in BigQuery continuous queries
Preview adds JOINs, aggregations, and windowing to streaming queries for richer real-time metrics.
- INFO Google Cloud Blog · 3 Oct 2026
Build highly available, multi-region services on Cloud Run
Service health is now GA and automates cross-region failover via readiness probes and load balancers.
- INFO Google Cloud Blog · 3 Oct 2026
Storage Intelligence Advisor for Google Cloud Storage is now GA
Advisor provides zero-setup metrics, anomaly detection, and recommendations for Cloud Storage cost and performance.
- INFO Google Cloud Blog · 3 Oct 2026
Safely run AI-generated code in Cloud Run sandboxes
Public preview adds isolated, lightweight sandboxes inside Cloud Run instances for running dynamic scripts securely.
- HIGH Google Cloud Blog · 2 Oct 2026
GKE Agent Sandbox generally available
Production-ready sandboxing technology for secure multi-tenant agent execution on GKE.
- MEDIUM Google Cloud Blog · 2 Oct 2026
Storage Intelligence advisor adds bulk operations and change detection
Enhanced tooling helps identify unexpected bucket changes and automate bulk storage-class or metadata updates.
- MEDIUM Google Cloud Blog · 2 Oct 2026
GKE HPA supports custom PromQL metrics
Scale workloads using custom Prometheus metrics in addition to standard metrics.
- MEDIUM Google Cloud Blog · 2 Oct 2026
GKE now supports native scale-to-zero with HPA
HPA with Autoscaling Metric and KEP-2021 enables built-in scale-to-zero without extra configuration.
- HIGH Google Cloud Blog · 2 Oct 2026
GKE Agent Sandbox for RL generally available
Optimized sandboxing and orchestration SDK for large-scale reinforcement learning loops on GKE.
- HIGH Google Cloud Blog · 2 Oct 2026
GKE Pod snapshots reduce AI inference cold starts by up to 89%
Save and restore CPU/GPU memory state of pods to cut inference startup latency.
- HIGH Google Cloud Blog · 2 Oct 2026
GKE Dataplane V2 supports 15 000 nodes with NetworkPolicy GA
Standard clusters can now scale to 15 k nodes while keeping full NetworkPolicy enforcement for large AI estates.
- MEDIUM Google Cloud Blog · 2 Oct 2026
gVisor sandboxes for Ray clusters on GKE in preview
Experimental library brings gVisor isolation to distributed Ray workloads with fast startup and low overhead.
- MEDIUM Google Cloud Blog · 2 Oct 2026
Strengthen your CI/CD pipeline with new Secure Source Manager capabilities
Google Cloud adds unified auth and authorization to Secure Source Manager to reduce software supply chain threats.
- MEDIUM Google Cloud Blog · 2 Oct 2026
Enabling Cloud Storage end-to-end checksums by default
Google Cloud Storage SDKs now compute and verify CRC32 checksums automatically for uploads and downloads, closing the in-flight bit-flip gap when clients omit checksums.
- INFO Google Cloud release notes · 2 Oct 2026
AlloyDB Columnar Engine as read-optimized cache for HNSW vector indexes
GA feature uses Columnar Engine as in-memory cache for vector indexes to accelerate search performance and increase QPS.
- INFO Google Cloud release notes · 2 Oct 2026
BigQuery query results history in Studio editor
GA feature shows recent query run history directly in the Query results pane without navigating to Job history tab.
- INFO Google Cloud release notes · 2 Oct 2026
BigQuery generative AI functions support gemini-3.8-flash model
BigQuery AI functions now support the gemini-3.8-flash Gemini model for generative AI workloads.
- HIGH ACT BY 7 OCT 2026 Google Cloud release notes · 2 Oct 2026
GKE Rapid channel: 1.36.4-gke.1391000 is new default
Rapid channel default moves to 1.36.4-gke.1391000; adds 1.34.11, 1.35.8, 1.36.4 and alpha 1.38.0 preview versions.
- INFO Google Cloud release notes · 2 Oct 2026
GKE ambient networking enters Preview with sidecarless service mesh
Preview allows allowlisted clusters to use node-level proxy for simplified L4 service mesh without sidecars.
- INFO Google Cloud release notes · 2 Oct 2026
Compute Engine X5 series GA: 48 TB instances
X5 series breaks 32 TB memory limit with 48 TB configs for SAP HANA and RISE with SAP workloads.
- INFO Google Cloud release notes · 2 Oct 2026
Cloud Run custom URLs in Preview
Custom easy-to-remember URLs like example.cloud.run available globally for Cloud Run services in Preview.
- INFO Google Cloud release notes · 2 Oct 2026
BigQuery continuous queries write to Apache Iceberg GA
Continuous queries can now write output rows directly to Apache Iceberg managed tables.
- INFO Google Cloud release notes · 2 Oct 2026
C4D machine series supports Hyperdisk Throughput GA
C4D machine series now generally available with Hyperdisk Throughput support.
News and tools 13
- INFO NEW THIS WEEK Google Cloud Blog · 2 Nov 2026
Beyond Migration: Using Database Migration Service for disk shrinking
Explains how Google Cloud Database Migration Service can replicate Cloud SQL for SQL Server instances to shrink disks with minimal downtime instead of native offline shrink.
- INFO NEW THIS WEEK Google Cloud Blog · 29 Oct 2026
IAM Helper introduces agent-facing skills for automated IAM workflows
New suite of intelligent building blocks automates complex end-to-end IAM operations for AI agents.
- MEDIUM NEW THIS WEEK Google Cloud Blog · 28 Oct 2026
Upgrade log bucket to Observability Analytics for Flow Analyzer
VPC Flow Logs analysis now requires the _Default bucket to be upgraded to Observability Analytics; the change is permanent.
- INFO Google Cloud Blog · 19 Oct 2026
Developer’s guide to implementing MCP apps in Gemini
MCP Apps add interactive widgets to Gemini Enterprise assistants so users can edit data live without extra chat turns.
- INFO Google Cloud Blog · 9 Oct 2026
Google-built ODBC driver for BigQuery in preview
Native ODBC driver offers high-performance connectivity from BI tools and apps without third-party layers.
- INFO Google Cloud Blog · 9 Oct 2026
Google-built JDBC driver for BigQuery in preview
Open-source JDBC driver gives Java apps a direct, high-performance path to BigQuery.
- INFO Google Cloud Blog · 6 Oct 2026
Networking for AI inference model serving - GKE only and for all other backends
Reference architectures for exposing AI inference models behind a secure, private entry point using Cloud Load Balancer, Inference Gateway, Apigee, and Model Armor for governance, safety, and routing.
- HIGH Google Cloud Blog · 3 Oct 2026
Apply Row-Level Security and Parameterized Secure Views for multi-tenant agent memory
Enforce PostgreSQL RLS and Parameterized Secure Views on the agent_entities table to isolate memory across users, projects, and teams in production environments.
- MEDIUM Google Cloud Blog · 3 Oct 2026
Now in Public Preview: AI-assisted EKS-to-GKE migrations
Open-source GKE Agentic Migration plugin automates EKS-to-GKE moves with deterministic guardrails and offline validation.
- HIGH Google Cloud Blog · 2 Oct 2026
k8s-aibom open-source tool auto-generates AI SBOMs on GKE
Lightweight controller discovers AI runtimes and produces CycloneDX ML-BOMs to reduce shadow AI risk.
- HIGH Google Cloud Blog · 2 Oct 2026
Multi-cluster GKE Inference Gateway for global GPU/TPU pooling
How-to shows routing traffic across regions with LLM-d router to treat worldwide accelerators as one pool.
- INFO Google Cloud Blog · 2 Oct 2026
Agentic hacks, real proofs: Inside Google's PageBreak project
Google Product Security introduces PageBreak, an internal AI agent that tests web app security and distinguishes real flaws from hallucinations.
- INFO Google Cloud Blog · 2 Oct 2026
How Google eliminates classes of vulnerabilities at scale
Principal security engineer explains building secure-by-design foundations for AI-era large-scale enterprises.
Only hear about Google Cloud when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.