Platform Pulse: Gemini 4 Argon, TimesFM 3.0 in BigQuery, and Scalable VPC-SC Perimeters

🔐 Zero-Trust Security, Identity & Threat Defence

Enterprise security architectures are advancing towards scalable service perimeters, sender-constrained OAuth tokens, turnkey Kubernetes runtime threat detection, and post-quantum cryptographic readiness.

Modernizing perimeter security: Scalable perimeters with VPC Service Controls: Google Cloud announces major architectural enhancements to VPC Service Controls that simplify creating, maintaining, and scaling data exfiltration perimeters across large, multi-folder enterprise environments.
Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes: Introducing the Wiz Runtime Sensor add-on for Google Kubernetes Engine in Preview, streamlining sensor deployment, lifecycle management, credential security, and real-time kernel threat detection across Kubernetes fleets.
Announcing DPoP Support for Google OAuth: Securing Refresh Tokens: Google OAuth Platform introduces support for Demonstrating Proof-of-Possession (DPoP) to cryptographically bind refresh tokens to the requesting client, neutralising infostealer malware and adversary-in-the-middle token replay attacks.
Cloud CISO Perspectives: New Gemini Notebook can help CISOs and policymakers prepare for PQC: Google Cloud Office of the CISO releases a dedicated post-quantum cryptography (PQC) Gemini Notebook to help security leaders and policymakers assess cryptographic inventories and plan quantum-resilient migrations.
ARMORY CASTLE Exploits BeyondTrust: Google Threat Intelligence Group (GTIG) and Mandiant analyse how threat actor ARMORY CASTLE exploited zero-day vulnerabilities in BeyondTrust Remote Support appliances to establish stealthy, persistent access across victim networks.
Investigating Ephemeral Supply Chain Tampering: GTIG and Mandiant uncover a sophisticated supply chain attack against AOMEI Technology's update infrastructure, detailing how adversaries used short-burst configuration tampering on origin servers to distribute the SHINYROAD trojan.
New to Google SecOps: Please, Please, Please, Let Me |> SELECT What I Want: A practical guide to using the GoogleSQL SELECT pipe operator in Google Security Operations to refine returned Unified Data Model (UDM) columns, format epoch timestamps into readable dates, and deduplicate results with DISTINCT.
IAP Desktop for Mac: how I reach GCP VMs with no public IP, without gcloud: Connecting securely to private Google Cloud Compute Engine virtual machines without public IP addresses or local gcloud CLI wrappers by leveraging Identity-Aware Proxy (IAP) TCP forwarding natively on macOS.
Chronicle Security Operations: Terraform Providers and Client Libraries: Terraform providers and Google Cloud client libraries are now available for managing Google SecOps resources as code via the Chronicle API, covering Feeds, Parsers, Rules, Retrohunts, Dashboards, Data Tables, Watchlists, and SOAR configurations.
VPC Service Controls: Automated Remediation Suggestions in Violation Analyzer: The VPC Service Controls violation analyser introduces automated remediation suggestions in Preview, inspecting access denial events to generate least-privilege ingress rules, egress rules, and context-aware access levels.
IAM: Revoking Active Sessions for Workforce Identity Federation Users: Revoking active sessions and short-lived credentials for Workforce Identity Federation principals across all clients reaches General Availability via the gcloud CLI and REST API.
Certificate Manager: Transitioning Public SSL Certificates to 45-Day Validity: Google-managed public SSL/TLS certificates signed by Google Public CA (pki.goog) are transitioning from a 90-day validity window to a 45-day lifecycle, enforcing more frequent automated key rotation across load balancers with zero manual intervention.
Application Integration: Mandatory IAM and Service Account Authorization Hardening: Application Integration enforces mandatory security patches for IAM, run-as service accounts, and iam.serviceAccounts.actAs permission checks in accordance with security bulletins GCP-2026-067 and GCP-2026-068.
Google Cloud Armor: Service Rate Limiting in Preview: Google Cloud Armor introduces service rate limiting policies in Preview to protect backend services against resource exhaustion and traffic spikes.
Secure Web Proxy: Outbound Service Rate Limiting Policies: Secure Web Proxy adds Preview support for attaching service rate limiting policies to outbound gateways to shield external destinations from traffic overloads and control egress bandwidth costs.

📊 High-Performance Databases, Lakehouse & Big Data Analytics

Data platforms are combining multivariate time-series foundation models with granular token cost governance, Spanner-backed Iceberg catalogues, and zero-ETL streaming pipelines.

Introducing TimesFM 3.0 with multivariate time-series forecasting in BigQuery: Google Research's 330-million-parameter TimesFM 3.0 foundation model arrives in BigQuery, unlocking native multivariate time-series forecasting with historical covariates directly inside AI.FORECAST SQL queries.
Predictable AI spend in BigQuery: Introducing cost management for generative AI functions: BigQuery introduces token-based cost management for generative AI SQL functions, enabling administrators to enforce daily quotas on AI token consumption per project or user to keep analytical AI workloads within budget.
Trusted Data Apps for the Agentic Data Cloud, powered by Looker: Looker unveils Looker Data Apps, allowing teams to describe business intelligence workflows in plain language while an autonomous agent constructs a governed, production-grade data application natively inside Looker.
Managed Apache Iceberg at scale: How Spanner powers Lakehouse runtime catalog: An architectural look under the hood of Google Cloud's Lakehouse runtime catalogue, detailing how Cloud Spanner underpins the Apache Iceberg REST catalogue specification to serve high-concurrency agentic workloads at global scale.
Cross-cloud conversational analytics made simple with open standards: Using Google Cloud's borderless Lakehouse and Apache Iceberg open standards to federate queries across Databricks, Snowflake, and AWS Glue for in-place cross-cloud conversational analytics.
Bringing the borderless Lakehouse into the agentic era with innovations for Gemini: New security controls and metadata integrations across Google Cloud's borderless Lakehouse enable governed Gemini agents to reason over distributed multi-cloud datasets.
AlloyDB: A unified database engine for hybrid search: AlloyDB AI combines dense vector similarity lookups and full-text keyword search with Reciprocal Rank Fusion (RRF) inside a single high-performance SQL query, eliminating complex multi-step application orchestration.
Agentic data science with the Data Agent Kit: A practical walkthrough of using the Data Agent Kit inside the Antigravity IDE and VS Code-based editors to accelerate data exploration, pipeline authoring, and statistical modelling on Google Cloud.
Migrating from MongoDB to Firestore Without Changing a Single Line of Code: Migrating existing MongoDB workloads directly to Cloud Firestore by updating only the connection string, taking advantage of native MongoDB wire-protocol compatibility and serverless scaling without rewriting application queries.
Spanner - Potential impact of change stream capture modes on writes: Analysing how different value capture modes in Cloud Spanner change streams affect write latency, detailing how certain configurations convert efficient blind writes into read-write transactions and increase lock contention.
Pub/Sub AI Bytes: Part 5 - Zero-ETL streaming direct to database with Bigtable subscriptions: Eliminating intermediary compute pipelines by using Cloud Pub/Sub Bigtable subscriptions to stream real-time event payloads directly into Cloud Bigtable tables in a zero-ETL architecture.
Pub/Sub AI Bytes: Part 6 - Building a real-time streaming RAG pipeline: Eliminating stale context in generative AI applications by building real-time streaming Retrieval-Augmented Generation (RAG) pipelines, comparing zero-code Pub/Sub Single Message Transforms against custom Cloud Dataflow chunking topologies.
Event-Driven AI at Cloud Scale: High-Throughput Stream Classification with Pub/Sub, Dataflow, and Jev: Building a high-throughput streaming classification pipeline with Cloud Pub/Sub, Cloud Dataflow, and TypeSafe's Jev model to process millions of events per hour into deterministic, confidence-scored decisions without heavy LLM overhead.
DuckLess: serverless DuckDB on Google Cloud, in your own project: Introducing DuckLess, an open-source framework for executing serverless DuckDB analytical workloads inside your own Google Cloud project using Cloud Run and Cloud Batch.
Prompting LLMs over your data at scale in Python with bigframes and BigQuery AI: Using BigQuery DataFrames (bigframes) and BigQuery AI in Python notebooks to prompt Gemini models, perform semantic ranking, and build scalable vector search pipelines without managing external infrastructure.
Domain-Driven BigQuery Column Security: Moving to Data Governance Tags: Implementing domain-driven column-level security in BigQuery for data mesh architectures using regional data policies, custom SQL masking routines, and automated dbt governance tags.
Learning BigQuery Graph with Nodes and Edges: Which Melbourne Cafes Are Neighbours?: A hands-on tutorial exploring BigQuery Graph's property graph capabilities, modelling nodes and edges to execute multi-hop spatial and relational graph queries in standard GQL.
Automating Snowflake-to-BigQuery dbt Migrations with AI Skills: Accelerating enterprise dbt project migrations from Snowflake to BigQuery by equipping coding agents with open-source Google Cloud AI skills to translate SQL dialects, macros, and configurations automatically.
BigQuery Cost Optimization: The Complete FinOps Framework: A four-layer FinOps pyramid for Google Cloud BigQuery, spanning query-level pruning and table storage design through to slot reservation autoscaling and enterprise commitment management.
Making Sense of BigQuery Pricing Models: On-Demand, Capacity, Editions (2026): A practical breakdown of BigQuery's 2026 pricing tiers, comparing On-Demand byte-scanned billing against Standard, Enterprise, and Enterprise Plus capacity editions.
The Zero-Cluster MLOps Blueprint: BigQuery ML, Cloud Run Jobs, and OpenTelemetry: Designing a serverless nightly machine learning scoring architecture that pairs BigQuery ML and Cloud Run Jobs with end-to-end OpenTelemetry distributed tracing.
Modernizing Unstructured Data Workflows: Alteryx Live Query meets Google Cloud BigQuery: Combining Alteryx One Live Query with BigQuery and Gemini to build code-free analytical pipelines that process and enrich unstructured enterprise data in place.
Google Looker API & AI Integration Guide: Connect AI Without Admin Access.: Practical patterns for connecting external AI scripts and agent workflows to Google Looker's semantic layer and APIs when operating with standard developer permissions rather than full administrator access.
Cloud SQL for MySQL: 100,000 PSC Connections and Blue-Green Deployments: Cloud SQL for MySQL adds support for up to 100,000 concurrent connections via Private Service Connect on 16+ vCPU instances, configurable managed buffer pool thresholds (innodb_cloudsql_managed_buffer_pool_tuneup_pct), and Preview support for blue-green deployments to minimise upgrade downtime.
Cloud SQL for PostgreSQL: 129,024 PSC Connections and Near Real-Time Knowledge Catalog Sync: Cloud SQL for PostgreSQL now supports up to 129,024 concurrent connections on Private Service Connect instances with 16+ vCPUs and syncs schema metadata updates to Knowledge Catalog in near real time.

⚡ Cloud-Native Infrastructure, GKE & Serverless Workloads

Infrastructure engineering is advancing with predictive Temporal worker scaling on Cloud Run, ultra-low-latency U4 compute, 5x faster distributed LLM serving on GKE, and a new decade of Site Reliability Engineering practices.

Temporal Serverless Workers on Cloud Run: Scale workers ahead of demand: Deploying Temporal workers as managed Cloud Run worker pools that autoscale proactively ahead of task queue demand, pairing durable execution orchestration with serverless compute elasticity.
10 Years of the SRE book: Announcing the second edition of "Site Reliability Engineering": Marking a decade since the original publication, Google announces the second edition of the Site Reliability Engineering book, rewritten to reflect modern operational paradigms across AI infrastructure, serverless platforms, and microservices.
Introducing Google Cloud’s U4 compute: Enabling ultra-low latency trading: The Ultra Low Latency Solution built on the Compute Engine U4 machine family reaches General Availability, delivering deterministic, ultra-low-latency networking tailored for high-frequency financial trading workloads.
Day 0 support for Reflection’s Beam on Google Cloud: 5x faster perf with llm-d and NVIDIA Dynamo: Google Cloud optimises Reflection AI's Beam model for agentic workloads on A4X Max instances using GKE, llm-d, and NVIDIA Dynamo, achieving up to 5x higher throughput and 8x lower latency via intelligent KV-cache routing.
AlloyDB Omni K8s Operator 1.9.0 release: The AlloyDB Omni Kubernetes Operator version 1.9.0 reaches General Availability, bringing enhanced high-availability orchestration and automated lifecycle management for self-managed AlloyDB Omni deployments on Kubernetes.
PHP on Cloud Run: Cut Your Latency with PHP 8.5 and Persistent Sockets: Leveraging PHP 8.5 persistent cURL share handles (curl_share_init_persistent) on Cloud Run to pool HTTP/2 connections across requests, dropping Google Cloud SDK TLS handshake latency to 0 ms while avoiding subtle libcurl pitfalls.
Cloud Run Can Scale Past Your Database Connection Budget: Calculating the true database connection footprint of autoscaling Cloud Run services by accounting for multi-process worker multipliers, connection pool overflow settings, and revision rollout overlaps.
Cost-Optimized Kafka Architecture on GCP Storage Pools: Re-architecting self-managed Apache Kafka clusters on Google Cloud from fixed-capacity disks to Hyperdisk Storage Pools, dramatically cutting provisioned storage costs while sustaining high broker throughput.
GCP Storage Pools: Cheap Boot Disks, emptyDir Vol & FSTRIM/DISCARD: Consolidating node boot disks, Trino caches, and Apache Spark shuffle spill volumes into thin-provisioned GCP Storage Pools with automated fstrim discard routines to reclaim unused block storage capacity.
IP Address Management on Google Cloud: Implementing IPAM in a Shared VPC with Terraform: Automating enterprise CIDR allocation and preventing subnet collisions across Shared VPC topologies by provisioning Google Cloud Internal Ranges and Cloud Number Registry resources via Terraform.
tfgcpvalidator: Catch Terraform deletion_protection failures on Google Cloud at plan time: Introducing tfgcpvalidator, an open-source validation tool that detects deletion_protection blocks across Google Cloud resources during terraform plan rather than failing midway through terraform apply.
Don’t Assume Your Cloud T4 Runs at Spec: Gemma 4 Decode Falls 7% as the Card Warms: Empirical benchmarking of NVIDIA T4 GPUs on Google Cloud running Gemma 4 inference, demonstrating how thermal throttling degrades token decode throughput by 7% under sustained load.
How Visko streams real-time world models on Google Cloud TPUs: How AI startup Visko brought Orbis, its interactive, continuously streaming video world model, from prototype to low-latency production on Google Cloud TPUs in just 30 days.
GKE: Confidential GKE Nodes with Intel TDX on C4 and MicroVM Sandboxes Reach GA: Google Kubernetes Engine makes Confidential GKE Nodes with Intel TDX on c4-standard-* instances (up to 192 vCPUs) Generally Available, alongside GA support for GKE Sandbox microVM sandboxes powered by Kata Containers and Cloud Hypervisor for untrusted AI agent runtimes.
Cloud Run: Interactive SSH Connections for Services and Instances in Preview: Cloud Run introduces SSH support in Preview for running services and instances, enabling engineers to establish secure, interactive shell sessions directly into live containers for real-time debugging.
Compute Engine: Hyperdisk Balanced HA on Z3 VMs and Sub-Millisecond Clock Sync: Compute Engine reaches GA for synchronous cross-zone replication with Hyperdisk Balanced High Availability on Z3 VMs, H4D capacity reservations with co-located Hyperdisk pools, and sub-millisecond VM clock synchronisation using chrony and ptp_kvm.
Virtual Private Cloud: TCP Connection Logging in VPC Flow Logs and Standard Tier IPv6: VPC Flow Logs reaches General Availability for capturing outbound TCP connection attempts and acknowledged inbound TCP connections across VMs and serverless endpoints, alongside Preview support for external IPv6 addresses in Standard Network Tier.
Network Intelligence Center: Packet Drop Analysis in Flow Analyzer: Flow Analyzer now displays packet drop telemetry directly within traffic flow visualisations, enabling network engineers to pinpoint and diagnose packet loss across VPC paths.

🛠️ AI Agents, Runtimes & Platform Modernisation

The agentic ecosystem is coalescing around Gemini 4 Argon, five-language Agent Development Kit interoperability, ambient production quality evaluation, and multimodal edge inference.

Gemini 4 Argon available on Google Cloud, built to help solve your business’ hardest problems: Google Cloud launches its new frontier model, Gemini 4 Argon, engineered for deep multi-step reasoning, autonomous software engineering, and complex enterprise problem-solving across Vertex AI and Gemini Enterprise.
Welcome to Gemini at Work 2026: Introducing the Gemini agent: Google Cloud unveils the Gemini agent at Gemini at Work 2026, a universal enterprise AI assistant that orchestrates multi-model workflows, writes production code, and integrates across business applications.
Introducing Google Cloud Modernize, transforming for (and with) AI: Announcing Google Cloud Modernize and the Modernization Hub, utilising autonomous AI agents to assess legacy estates, automate code refactoring, and accelerate enterprise cloud migrations.
One Agent Development Kit, five languages: Google's Agent Development Kit (ADK) now spans five programming languages (Python, Go, TypeScript, Java, and Kotlin), enabling engineering teams to build interoperable multi-agent systems using shared Model Context Protocol (MCP) and Agent-to-Agent (A2A) standards.
Three layers, one repo: a tour of google/adk-recipes: Touring the google/adk-recipes repository, which organises Agent Development Kit resources into core/, plugins/, and contrib/ layers to provide production reference patterns and installable vertical skills.
Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon: How Google's engineering team ran Gemini 4 Argon unattended overnight using .agents/skills and /goal mode to slash in-memory session preparation overhead by 40% and speed up cold imports by 21% in the Python ADK codebase.
Announcing MCP support in Apigee hybrid: agentic tools that run in your own cluster: Apigee hybrid 1.17.0 introduces native Model Context Protocol (MCP) support, allowing the MCP data plane to execute entirely inside customer-managed Kubernetes clusters while synchronising governance policies from the cloud control plane.
Announcing MCP Toolbox Java SDK v1.0: Agentic data access for the enterprise: The MCP Toolbox Java SDK reaches v1.0, providing enterprise Java and Spring Boot developers with type-safe tool orchestration, decoupled authentication, and native AlloyDB integration.
Supercharge your development with the Google Developer Knowledge API ecosystem: Google launches the Developer Knowledge API and official MCP Server in Public Preview, giving AI coding assistants a canonical, machine-readable interface to retrieve up-to-date documentation across Google Cloud, Firebase, and Android.
Evaluating AI agents: moving past the vibe check: An engineering blueprint and reference architecture for establishing continuous, automated evaluation pipelines for multi-turn AI agents using Gemini Enterprise Agent Platform, Google ADK, and OpenInference telemetry standards.
The Outer Loop, Insights First: An Ambient Quality Agent That Diagnoses Your Production Agent: Google open-sources AQuA (Ambient Quality Agent), an out-of-band diagnostic agent that runs alongside production agents on Google Cloud to sweep conversation transcripts, cluster silent quality regressions, and pinpoint root causes against deployed source snapshots.
Four evaluation engineering lessons learned from building agent plugins: Four practical evaluation engineering lessons from building the Google Cloud developer plugin for coding agents, covering trajectory grading, deterministic assertions, and benchmark maintenance.
Your Agent’s Memory Is Drifting and Your Dashboards Look Fine: Explaining why AI agent memory stores degrade over time through stale facts, contradictions, and duplicates despite healthy infrastructure metrics, and how Agent Platform Memory Bank mitigates semantic drift.
Google Cloud’s Agentic AI Blueprint: From Design Patterns to Private Inference Networking: A comprehensive architectural guide to building production agentic systems on Google Cloud, linking multi-agent design patterns and memory selection with private inference endpoints and VPC security controls.
Deploying an ADK agent on Agent Runtime with Terraform and CI/CD: Bridging the gap from local prototype to enterprise production by provisioning and deploying Google ADK agents onto Google Cloud's managed Agent Runtime via Terraform and automated CI/CD pipelines.
Building Agents to Analyze Structured and Unstructured Data: Combining Google ADK and Cloud Spanner to build a multi-tool agent capable of querying structured relational tables alongside SQL-generated vector embeddings over unstructured text, complete with security guardrails.
9 Mistakes to Avoid When Building Gemini Enterprise Agents: Nine architectural anti-patterns to avoid when deploying Gemini Enterprise agents over BigQuery, addressing identity propagation, dataset permission scoping, and tool boundary design.
Stop building one proxy per model: Consolidating disparate model-specific API proxies into a single, governed, OpenAI-compatible AI gateway on Apigee to centralise authentication, rate limiting, and routing across foundation models.
Cost per task: Using cheap classifiers to route across Gemini models and thinking levels: Optimising the unit economics of autonomous coding agents by training lightweight intent classifiers to dynamically route requests across Gemini models and thinking budgets based on task complexity.
Gemini 2.5 on Vertex AI Retires October 20: What to Switch To (and What It Costs): A migration and pricing guide preparing engineering teams for the October 20, 2026 retirement of Gemini 2.5 models on Vertex AI, comparing replacement Gemini 3.x and 4.x model tiers.
Bring multimodal semantic search to the edge with EmbeddingGemma 2: Introducing EmbeddingGemma 2, a 740M-parameter open-weight multimodal embedding model that maps text, images, audio, and video into a unified vector space for on-device retrieval via MediaPipe and LiteRT.
EmbeddingGemma 2: The Developer Guide: A technical guide to integrating EmbeddingGemma 2 with sentence-transformers, detailing how to selectively load modular modality encoders from 270M to 740M parameters to optimise memory footprints.
ML Drift: Next-Gen GPU AI/ML Inference at the Edge: Google AI Edge introduces ML Drift, a cross-platform GPU compute framework that abstracts OpenGL ES, OpenCL, Metal, and WebGPU to accelerate on-device generative AI and vision workloads.
Architecting autonomy: A design pattern for high-compute, governed agents in biotech: Reference design patterns for orchestrating long-running, stateful, GPU-bound molecular simulation and biotech workloads using governed AI agents on Google Cloud high-performance computing infrastructure.
The SAVE method: Learn the fundamentals to engineer trustworthy generative media: Google Cloud Consulting introduces the SAVE methodology, establishing engineering principles for provenance, safety, and quality control in enterprise generative media pipelines.
What the Gemini agent means for startups: Five ways early-stage founders can leverage the new Gemini agent for business to automate operational workflows and accelerate product velocity across the Google ecosystem.
Empowering SMBs to do more with Gemini: How small and medium-sized businesses are adopting agentic capabilities across Gemini Enterprise, Google Workspace, and Google Ads to scale operations.
Innovation in Ireland: How Irish brands scale with Gemini Enterprise: Case studies highlighting how Irish enterprises, startups, and public sector agencies are embedding Gemini Enterprise agents into core operational workflows.
Where mission meets moonshot: Join us at the Google Public Sector Summit 2026: Previewing the Google Public Sector Summit 2026 in Washington, D.C., focusing on how Google's AI stack and secure cloud infrastructure support government mission outcomes.
GCP Bytes Podcast Episode #51: Discussing Gemini 4 leaks, Gemini Code Review, the Waratah Super Battery, GDG community updates, Darwin connectivity, and recent frontier model benchmarks.

📋 Essential Release Notes

A curated review of runtime additions, enterprise security controls, and managed infrastructure milestones rolling out across Google Cloud.

BigQuery (October 12): BigQuery generative AI functions add General Availability (GA) support for gemini-4-argon; the AI.AGG semantic aggregation function and its output_schema argument reach GA; incremental transfers for PostgreSQL and ServiceNow in BigQuery Data Transfer Service enter GA; Dataproc Metastore to Lakehouse migrations and the Apache Hive catalogue endpoint in Lakehouse runtime catalogue reach GA; cross-region table copying and opt-in GoogleSQL column aliases are GA; and Conversational Analytics agent publishing to Gemini Enterprise with PDF/CSV export reaches GA.
BigQuery (October 5): Built-in TimesFM 3.0 multivariate time-series forecasting (AI.FORECAST, AI.EVALUATE, AI.DETECT_ANOMALIES) and AI.CAUSAL_EFFECT intervention analysis enter Preview; gemini-embedding-2 multimodal embeddings reach GA; flexible column names for Apache Iceberg tables and inline Gemini SQL assistance reach GA; and Dataflow CDC ingestion from Delta Lake and Apache Iceberg into Lakehouse enters Preview.
Compute Engine: Storage-optimised Z4M instances (up to 1,536 GB RAM, 168,000 GiB local Titanium SSD, and 400 Gbps bandwidth with Cloud RDMA) and network-optimised C4N instances with Titanium SSD reach GA. Online resizing for multi-writer Hyperdisk volumes, specifically targeted future reservation requests, and regional read-only projectViews and imageViews endpoints for control-plane resilience also reach GA, while regional disk cloning from zonal boot disks enters Preview.
Cloud Billing: Spend cap budgets reach General Availability (GA) for eligible services, enabling administrators to automatically pause project resource usage via the Cloud Console or Cloud Billing Budget API when estimated gross spend exceeds defined budget thresholds.
Cloud Run: Support for Cloud Billing budget spend caps to automatically pause Cloud Run workloads upon threshold breach reaches General Availability (GA).
Load Balancing: RE2 regular expression matchers (regexMatch) for URL paths, HTTP headers, and query parameters in Application Load Balancer URL maps reach GA across global, regional, and cross-region deployments. Service rate limiting policies for regional internal Application Load Balancers enter Preview.
Cloud Storage: Object enrichments enter Preview, automatically applying pre-trained ML models to images and PDFs in buckets and attaching searchable metadata as object contexts queryable via BigQuery Storage Insights (object_contexts_catalog_view).
Cloud SQL for PostgreSQL: Private Service Connect (PSC) is now the default private IP connectivity option for new Cloud SQL for PostgreSQL instances, enabling multi-VPC access and automated DNS provisioning.
Config Connector: Version 1.159.0 adds Cloud SQL Enterprise Plus disaster recovery pair setup (sqlinstance-advanced-dr), Autopilot privileged admission configuration on ContainerCluster, and alpha direct reconcilers for AIPlatformReasoningEngine, EventarcPipeline, and NetworkSecurityDNSThreatDetector.
Dataform: Preserving BigQuery data policies and governance tags across table executions via preserveGovernanceControls reaches GA, and connecting Dataform repositories to Secure Source Manager via Developer Connect enters Preview.
Dataflow (October 15): Auto VM Selection adds support for 4th generation Compute Engine machine series, automatically prioritising newer generation VMs at job startup with seamless fallback to 2nd generation families.
Dataflow (October 9): Preview support for Change Data Capture (CDC) ingestion from Delta Lake and Apache Iceberg tables into borderless Lakehouse Apache Iceberg tables using batch and streaming Dataflow jobs.
Datastream: Datastream adds support for replicating SQL Server GEOMETRY and GEOGRAPHY spatial data types into BigQuery.
Dataplex: Data products in Knowledge Catalog reach General Availability for packaging, governing, and sharing Looker (Google Cloud core) dashboards, Looks, Explores, and LookML assets via Google Group mirroring and IAM controls.
Cloud Memorystore: RDB snapshots are now enabled by default in General Availability when provisioning new Memorystore for Redis instances in the Google Cloud Console to ensure baseline persistence.
Cloud DNS: Outbound Endpoints for Cloud DNS enter Preview, enabling direct private-IP DNS query forwarding from VPC networks to external and on-premises resolvers via forwarding zones or server policies.
VPC Service Controls: Preview support for specifying Workload Identity Federation for GKE principals (by Kubernetes service account, namespace, or entire cluster) directly within perimeter ingress and egress rules.
Security Command Center (October 15): Risk Engine attack path simulations introduce the EXTERNALLY_EXPOSED_VM_INSTANCE finding category in Preview to prioritise Compute Engine and GKE hosts with direct public IP OS access.
Security Command Center (October 6): Continuous export to Pub/Sub and BigQuery now supports real-time notifications when findings are deleted due to data retention policies, while Artifact Guard CI/CD integration is deprecated ahead of its October 30, 2026 shutdown.
Chronicle & Chronicle SOAR: Applied Threat Intelligence (ATI) curated detection rules now match against the unified GTI_IOC feed following the deprecation of legacy Mandiant and open-source indicator feeds, while the Chronicle SOAR API migration deadline is extended to March 31, 2027.
Looker: Looker (Google Cloud core) 26.18 introduces Preview support for Workforce Identity Federation as a primary authentication method with optional secondary Google OAuth fallback.
Agent Assist & Dialogflow: Gemini transcribe live reaches General Availability in Agent Assist for real-time streaming audio transcription, while gemini-3.5-flash-lite reaches General Availability in Dialogflow.
Gemini Code Assist: Sales of new Gemini Code Assist Standard and Enterprise subscriptions have ended as of October 9, 2026 (with auto-renewal ending in 2027), transitioning enterprise AI developer workflows to Google Antigravity and Gemini Enterprise Agent Platform.
Cloud Architecture Center: Reference architectures for single-agent, multi-agent, and distributed analytics systems have been updated with production governance patterns leveraging Agent Identity, Agent Gateway, Agent Registry, and Model Armor.
Cloud Asset Inventory: Public availability of networkservices.googleapis.com/AgentGateway resources across ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search APIs.
Cloud Monitoring: Bulk registration of discovered services and workloads to an App Hub application reaches General Availability (GA).
Cloud Build: Build configurations and private pools now support configurable release channels to control update frequencies for underlying Debian and Docker runtime versions.
Backup for GKE: Backup for GKE expands regional availability to asia-southeast3 (Bangkok, Thailand).
NetApp Volumes: Active Directory policy connection testing enters Preview for the Flex Unified service level, alongside regional expansion of Flex Unified custom performance to europe-west8 (Milan).
Apigee Integrated Portal: Security hardening patch strictly enforces TLS 1.2+ connections on the Portal SSO endpoint, rejecting deprecated TLS 1.1 handshakes.
Cloud Vision & Video Intelligence APIs: Emotion-related label responses in face detection are officially deprecated across both Cloud Vision API and Cloud Video Intelligence API, returning UNKNOWN for all emotion classifications going forward.
Managed Service for Apache Spark: Image version 2.1.120 restores the py4j library across Debian, Rocky Linux, and Ubuntu cluster images, while Serverless for Apache Spark adds support for specifying short template names during session creation.
Network Connectivity Center: Resolves a billing calculation issue for producer VPC spokes linked to Network Connectivity Center hubs so hourly usage fees accurately reflect standard pricing.