#510 Issue
July 6, 2026
Welcome to issue #509 June 29th, 2026
News
Cloud Logging Monitoring Official BlogLog Analytics is now Observability Analytics: Query logs and traces with SQL - Observability Analytics, formerly Log Analytics, lets you query logs and traces with SQL, and manage buckets programmatically with its API.
BigQuery Official Blog PythonBoost BigQuery with Python: Managed Python UDFs now generally available - Managed Python User-Defined Functions (UDFs) in BigQuery let you define and execute Python scalar functions directly within your BigQuery SQL queries.
AI Confidential Computing Official Blog SecurityVerifiable, private AI: Google Cloud expands Confidential Computing frontiers - To help further strengthen verifiable privacy in cloud AI deployments, here’s our latest Confidential Computing innovations.
Backup and DR Service Official BlogEnhanced data resilience with cross-region backups in Backup and DR Service - With new cross-region backups for Backup and DR Service, backup regions can be distinct from the region where the primary workload is located.
Cloud Monitoring Official BlogFrom query to action: Introducing SQL alerting in Cloud Monitoring Observability Analytics - Cloud Monitoring Observability Analytics lets you create alerts from (and get alerted about) analytical SQL queries of logs and traces.
Agents VPC Service ControlsSecuring agentic AI with perimeter guardrails: What's new in VPC Service Controls - Designed for agentic workloads, new capabilities in VPC Service Controls can help establish a network-level, destination-based perimeter.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Official Blog Threat IntelligenceZero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager - The threat actor exploited the vulnerability to escalate privileges from a compromised administrative account to root-level access.
Official Blog Threat IntelligenceSTOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus - Analysis of a backdoor, STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla.
AI FinOpsNext-Gen FinOps: Optimizing ROI and Observability in the Agentic Era - From Reactive Dashboards to Real-Time Granularity: Spend Caps, Smart Anomaly Detection, and Optimization APIs.
SecurityHow to Ingest Cisco Switch Syslogs into Google SecOps Using a Headless Raspberry Pi 5 - This guide provides a detailed lab setup for ingesting Cisco switch syslogs into Google SecOps using a headless Raspberry Pi 5. It outlines the configuration of split-routing, custom NetworkManager keyfiles, and critical Cisco IOS header sanitization to ensure flawless Unified Data Model (UDM) mapping. The article offers a step-by-step approach to bridge legacy network infrastructure with modern cloud security platforms, demonstrating the entire pipeline from setup to validation.
App Development, Serverless, Databases, DevOps
Firebase Javascript Official BlogZero-flicker Firestore SSR with React - This article explains how to use Firebase JS SDK APIs to build fast, server-rendered Next.js applications that seamlessly transition to real-time client-side synchronization without duplicate database reads or visual layout flickers.
AI Cloud Firestore Cloud Run Official BlogThe Starter Tier for Google AI Studio explained - Launch your Google AI Studio prototypes instantly with the Google Cloud Starter Tier. Deploy web apps using Cloud Run and Firestore—no billing account needed.
AIMeasuring What Matters with Jules - AI coding agents are evolving into proactive engines that continuously absorb context and identify risks, moving beyond reactive task completion. Researchers at Google Labs are developing a new evaluation method to assess these agents' "insight policy" for higher-level goals, using clustered historical bug fixes to establish ground truth. Preliminary results show the diagnostic logic is effective, with agents successfully identifying relevant insights and improving accuracy with increased exploration.
AI Cloud Run DevOps GPUA Guide to AI Cold Starts on Cloud Run - This article explores practical architectural and infrastructure strategies to minimize severe cold start latencies when deploying AI models on Cloud Run serverless GPUs.
AI BigQuery Data AnalyticsThe Semantic Brain & Operational Muscle: Solving the Enterprise AI Context Deficit - With Google Cloud Knowledge Catalog and Gemini Enterprise.
BigQuery Cloud Firestore PythonBridging the OLAP/OLTP Divide: Container-First Data Syncing with Python and Kestra - This article explores a container-first strategy for efficiently synchronizing data between OLAP (BigQuery) and OLTP (Firestore) databases. It details building a stateless bridge with Python and Kestra in Kubernetes, where change detection is offloaded to the data warehouse using `row_hash` for optimal performance. This method offers a simpler and scalable alternative to traditional reverse ETL tools for keeping live applications updated.
BigQuery PaywallManaging BigQuery with Google ADK, MCP, Cloud Run, Streamlit, and OIDC Authentication - Building a production-ready conversational analytics platform with Google ADK, BigQuery MCP, Streamlit, Cloud Run, and OIDC authentication.
AI Cloud Tasks ServerlessFrom pg-boss to Cloud Tasks: Fixing Queue Bursts and DB Connection Failures on Serverless - This article details a company's transition from `pg-boss` to `Google Cloud Tasks` to resolve queue bursts and database connection failures in their serverless environment.
Cloud Run FirebaseGCP Cloud Run vs Firebase Hosting: A Deployment Guide for Non-Developers - Both are made by Google — so what’s actually different?
Cloud Run Data ScienceR Shiny and Google Cloud Run - R Shiny enables the creation of interactive web applications and dashboards from R analysis. To deploy these apps with greater control over resources and scalability, Google Cloud Run offers a serverless platform, requiring the Shiny app to be packaged using Docker. This method is ideal for complex, public-facing, or frequently updated dashboards.
DevOps NoSQL Workload Identity FederationPasswordless Between Google Cloud and MongoDB Atlas - This article demonstrates how to establish secure, passwordless connections between Google Cloud workloads and MongoDB Atlas using Workload Identity Federation. It explains that applications can prove their identity with short-lived cryptographic tokens, eliminating the need to store and manage traditional secrets like usernames and passwords.
Big Data, Analytics, ML&AI
AI GeminiHow to Use Your Google Cloud Credits for Gemini Again, via Vertex AI and ADC
BigQueryCut Your BigQuery Bill in Half Without Rewriting a Single Query - On-demand vs. slots, partitioning, clustering, and the one preview button that stops $60 mistakes before they run.
BigQuery DataformDataform Incremental Load Optimizations - Four practical techniques that dramatically reduced BigQuery costs and execution time for production Dataform incremental pipelines.
Airflow Cloud Composer PaywallOptimising Airflow: Cutting DAG parse time even more through configuration — a practical guide (Part 2) - This guide details how to optimize Airflow DAG parsing times in large environments by tuning scheduler-level configurations, building on code-level improvements. It explains specific settings like `parsing_processes` and `min_file_process_interval` to enhance scheduler responsiveness and overall platform health. The article also addresses the standalone DAG processor in Airflow 3.0, the use of `.airflowignore`, and the role of underlying infrastructure in performance.
BigQuery DataformHow to solve Environment Promotion and Isolation in Dataform - This article details how to overcome challenges in Dataform CI/CD by moving beyond "hope-based" deployments and continuous compilation. It proposes leveraging the Dataform API for programmatic compilation and version pinning. Two strategies are presented: Git Tag Promotion for simplicity, and using an External State Store for enhanced audit trails and metadata, both enabling robust environment isolation.
Agents AI GCP Experience Gemma Official BlogOpen models, global networks: How AT&T and GSMA are accelerating telecom innovation with Gemma - The scale, complexity, and specificity faced by telecom providers means domain-specific models remain the best way to achieve dramatic network and process automation and agentic workflows.
Google Kubernetes Engine LLM TPUAccelerate TPU model loading while saving RAM on GKE - Large language models on TPUs often face significant "cold start" bottlenecks due to slow loading times and excessive memory usage from double-buffering. The new Run:ai Model Streamer, now integrated with Google Cloud Storage, directly streams model tensors from storage, bypassing local disk and eliminating the double-buffering trap. This dramatically accelerates model loading and reduces peak memory consumption, enabling faster and more efficient scaling of vLLM inference pipelines on Google Kubernetes Engine.
AI BigQuery Data AnalyticsFrom What to Why: Unlocking Key Driver Analysis in BigQuery with AI.KEY_DRIVERS - BigQuery has launched AI.KEY_DRIVERS in Public Preview.
Agents BigQuery Data ScienceArchitectural Trade-offs in Building Data Foundations for Agentic AI - This article examines the crucial architectural trade-offs when designing data foundations for agentic AI, distinguishing between operational and analytical datastores. It highlights that operational databases, like AlloyDB, are best for real-time, low-latency user interactions requiring immediate consistency, while analytical data warehouses, such as BigQuery, excel at high-throughput historical data scanning for strategic insights. The appropriate choice depends on whether the AI agent supports a user experience loop or an asynchronous analytical process, with critical implications for performance and data consistency.
Agents MCP MonitoringWho Wrote That Query? - Tracing AI Agents from Prompt to Execution with SQLCommenter.
GeminiFrom ADK to Gemini Enterprise: Building Production-Grade AI Agents on Google Cloud - A Deep-Dive Architectural Guide for Scaling Autonomous Enterprise Workflows Using the Vertex AI Agent Builder Ecosystem.
ADK LLM PaywallGoogle ADK Explained: Building Multi-Agent Systems With Google’s Agent Development Kit - A Practical Introduction to Google’s Code-First Agent Framework.
ADK Agents MCPBuilding AI Agents with Google Cloud Managed MCP Servers and ADK - Google Cloud now offers managed, remote MCP (Model Context Protocol) servers, standardizing how AI agents connect to Google Cloud services like BigQuery and Cloud Run. This significant shift simplifies AI agent development by providing secure, pre-built integrations, allowing developers to focus solely on agent logic rather than complex infrastructure and custom integrations.
ADK Agents MCPManage Your Entire Google Cloud with AI Agents - How We Built AgenticOps Using Google ADK, MCP Servers & Gemini.
AI GeminiMastering Gemini Computer Use : A Comprehensive Hands-on Guide - Gemini Computer Use empowers AI agents to interact with computer screens by visually interpreting screenshots and performing actions like clicking or typing, mimicking human behavior. This approach moves beyond fragile selector-based automation, enabling AI to operate diverse applications including web, mobile, and legacy desktop software, even those without APIs.
ADK AI Go Java Python TypescriptBuild Cross-Language Multi-Agent Team with Google’s Agent Development Kit and A2A
Releases
Application Integration - Security bulletins page See the new security bulletins page for Application Integration. Use it to stay informed about related security updates, vulnerabilities, and remediations. For more information, see Security bulletins.
Backup and DR Service - Announcing the general availability (GA) of cross-region backups for Backup and DR Service. Customers can now protect Compute Engine instances, Compute Engine disks, and Filestore instances against regional outages by storing backups in a distinct secondary region of their choice. This functionality enhances disaster recovery capabilities, provides a cost-effective way to ensure regional resilience, and helps maintain strict control over data residency. To learn more, see Backup vaults for immutable and indelible backups. You can now configure application-consistent backups for Compute Engine instances directly through the Google Cloud Console. This enhancement allows you to enable Guest Flush or VSS options within Backup Plans, ensuring data integrity for applications running on Linux or Windows VMs during the backup process. The Back up Compute Engine instances documentation has been updated with instructions on how to create and modify backup plans to use this feature.
BigQuery - You can use the BigQuery Data Transfer Service to transfer metadata from the following data sources into Knowledge Catalog: Oracle MySQL This feature is in Preview. Conversational analytics in BigQuery is now generally available (GA) and includes the following features: You can select whether an agent can only use generally available models, or a mix of preview and generally available models. You can change the thinking mode of an agent within a conversation. Agents can ask clarifying questions about your input prompt. Agent responses include context citations, to help you understand the specific sources used to generate the answer. Parameters are supported in verified queries. Agents can use the following AI functions to answer your questions: AI.KEY_DRIVERS AI.IF AI.SCORE AI.CLASSIFY AI.SIMILARITY AI.SEARCH Conversational analytics supports US MREP and EU MREP locations that govern the storage of agent and conversation resources, and the location used for ML processing. You can also create a conversation with a dataset. This feature is in preview. You can now configure your BigQuery pipelines to automatically trigger executions based on updates to specific BigQuery tables. For more information, see Trigger-based scheduling. This feature is in Preview. Conversational analytics in BigQuery is now generally available (GA) and includes the following features: You can select whether an agent can only use generally available models, or a mix of preview and generally available models. You can change the thinking mode of an agent within a conversation. Agents can ask clarifying questions about your input prompt. Agent responses include context citations, to help you understand the specific sources used to generate the answer. Parameters are supported in verified queries. Agents can use the following AI functions to answer your questions: AI.KEY_DRIVERS AI.IF AI.SCORE AI.CLASSIFY AI.SIMILARITY AI.SEARCH You can also create a conversation with a dataset. This feature is in preview. BigQuery now supports the gemini-3.1-flash-lite and gemini-3.5-flash GA models, which are available for the us, eu, and global multi-regional endpoints. You can use these models in all generative AI functions. For information about how to specify a multi-regional endpoint and how endpoints are selected, read about locations in the generative AI overview. BigQuery now supports the gemini-3.1-flash-lite and gemini-3.5-flash GA models, which are available for the us, eu, and global multi-regional endpoints. For information about how to specify a multi-regional endpoint and how endpoints are selected, read about locations in the generative AI overview. You can now use the VECTOR_SEARCH function to combine a semantic search with a lexical (keyword) search. This is known as a hybrid search. You can also extend a vector index to include keyword information to improve the speed of the lexical search portion of a hybrid search. This feature is in Preview. An updated version of the Simba ODBC driver for BigQuery is now available.
Bigtable - You can create hot backups and modify all backups in Bigtable Studio. For more information, see Manage backups.
Billing - Resource-based CUD recommendations available for Compute Engine GPUs, Local SSD disks, and OS licenses Resource-based committed use discount (CUD) recommendations are generally available (GA) for GPUs, Local SSD disks, and premium operating system (OS) licenses. CUD recommendations provide insight into any additional commitments that you can purchase to optimize the costs of the resources that you run. You can use these recommendations and purchase commitments for resource usage that isn't covered by commitments and is being charged at list prices. Google Cloud analyzes your compute instance spending trends with and without a commitment and generates CUD recommendations on a monthly basis. For more information about how CUD recommendations are generated, what resource types are supported, and how to use recommendations to purchase commitments, see Get recommendations for committed use discounts (CUDs).
CDN - Cloud CDN and external Application Load Balancers support self-service Private Bucket Access for Cloud Storage buckets. This feature allows you to securely serve content without making your storage buckets public. The access on the buckets is managed securely via IAM permissions on a Google-managed service account. This feature is Generally Available. For more information, see Private bucket access.
Chronicle SOAR - Visit the release page for the full description.
Chronicle Security Operations - The full details on the release page.
Cloud Build - For GitLab Enterprise and Bitbucket Data Center connections, Cloud Build now checks permissions on the calling principal. When you create or update repository connections, Cloud Build uses Secret Manager secrets to authenticate to third-party Git providers. Previously, these referenced secrets were retrieved by the Cloud Build service agent (P4SA) on your behalf, checking permissions only against the P4SA's credentials rather than those of the calling principal. To adhere to the security principle of least privilege, Cloud Build now checks permissions on both the calling principal (using end-user credentials) and the P4SA, to ensure both have the secretmanager.versions.access IAM permission on the referenced secrets. This check only affects GitLab Enterprise (GLE) and Bitbucket Data Center (BBDC) connections. For instructions and more details, see the Cloud Build security bulletin.
Cloud Logging - If the parent project for a Cloud Storage bucket changes, a log sink stops routing log entries to that bucket. For more information about error messages and recovery options, see Errors routing to Cloud Storage.
Cloud Monitoring - Metrics Explorer can automatically break down a chart into a series of tiles, with each displaying time-series data for a specific label key. This view helps you identify spikes, dips, or trends that the aggregation settings might otherwise hide. To learn more, see Break down a chart by labels. Support for applying role-based access controls (RBAC) to Cloud Monitoring dashboards and alerting policies using Tags is generally available. You can use Tags to protect Terraform-managed Cloud Monitoring resources and configure team-scoped access. For more information, see Use Tags to control access to resources.
Cloud SQL MySQL - Customer-managed encryption key (CMEK) support for Cloud SQL enhanced backups is generally available. You can protect your CMEK-enabled Cloud SQL instances using Google Cloud Backup and DR Service. For more information, see Choose your backup option. You can now assess the upgrade readiness of your Cloud SQL for MySQL instances before a major version upgrade by running a precheck. This precheck analyzes your instance for version incompatibilities and lists any issues that need to be fixed prior to your upgrade. For more information, see Assess upgrade readiness for your instance. This feature is in Preview.
Cloud Spanner - Spanner supports direct connectivity. When enabled, your application traffic is routed directly to Spanner servers, bypassing the Google Front End (GFE) servers. This can reduce your overall latency. Direct connectivity is generally available (GA).
Compute Engine - Generally available: Resource-based committed use discount (CUD) recommendations are available for GPUs, Local SSD disks, and premium operating system (OS) licenses. CUD recommendations provide insight into any additional commitments that you can purchase to optimize the costs of the resources that you run. You can use these recommendations and purchase commitments for resource usage that isn't covered by commitments and is being charged at list prices. Google Cloud analyzes your compute instance spending trends with and without a commitment and generates CUD recommendations on a monthly basis. For more information about how CUD recommendations are generated, what resource types are supported, and how to use recommendations to purchase commitments, see Get recommendations for committed use discounts (CUDs). Generally available: You can create instances all at once in a regional managed instance group (MIG) by using resize requests. For more information, see About resize requests in a MIG. Preview: You can use Gemini in the Google Cloud console as an AI-powered interface to evaluate hardware options, estimate deployment costs, and view recommended configurations for your Compute Engine instances. Prompting Gemini helps you reach an optimal configuration for your workload before you create or modify a compute instance. For more information, see Design your compute infrastructure with Gemini. Generally available: You can cancel a future reservation request in calendar mode to prevent Compute Engine from provisioning your requested resources and incurring unnecessary charges. For more information, see Delete a future reservation request in calendar mode. Generally available: In a managed instance group (MIG), you can use a health check to monitor your application health without triggering repairs for an unhealthy VM, if the application fails the health check. You can prevent the MIG from repairing an unhealthy VM by turning off autohealing. For more information, see Turn off repairs in a MIG.
Config Connector - Bug Fixes: #8025: SQLInstance: Fixed case sensitivity in availabilityType. #7743: Preview Tool: Fixed crash on typed resources and hang on defaulting in preview mode. #7371: ComputeForwardingRule: Fixed target field matching. #8479: ComputeFutureReservation: Fixed validation logic for future reservation times. Reconciliation Improvements: Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support: ComputeReservation FirestoreIndex New Fields: ComputeReservation Added spec.shareSettings field. ComputeForwardingRule Added status.target field. Config Connector version 1.152.0 is now available.
Contact Center AI Platform - The full details on the release page.
Database Migration Service - Database Migration Service for MySQL homogeneous migrations now supports MySQL version 9.7. For more information, see Supported source and destination databases.
Dataflow - You can now use Hyperdisk Balanced disks for Dataflow worker VMs. With Hyperdisk Balanced disks, you can provision IOPS and throughput independently of disk size by using the diskProvisionedIOPS and diskProvisionedThroughput pipeline options (Java SDK) or disk_provisioned_iops and disk_provisioned_throughput_mibps pipeline options (Python and Go SDKs). For more information, see Disk type and Provision IOPS and throughput.
Dataplex - Knowledge Catalog connectors for importing metadata from Oracle and MySQL data sources are available in Preview. Knowledge Catalog connectors automatically extract metadata (technical, operational, and business) from external data sources and import it into Knowledge Catalog entry groups. You can schedule metadata import runs on a set schedule. For more information, see About database connectors and Manage connector jobs. You can control data lineage ingestion for BigQuery and Managed Service for Apache Airflow at the organization, folder, or project level. This feature is available in preview. For more information, see Control data ingestion.
Dataproc - Check the release page for full description
Google Distributed Cloud Edge - This is a patch release of Google Distributed Cloud connected (version 1.11.2). Google Distributed Cloud software updates roll out gradually across regions. The latest version might not be immediately available on your Google Distributed Cloud connected deployment. The following issues have been resolved in this release of Google Distributed Cloud connected: Machines with long uptime no longer become randomly unresponsive. A slow memory leak in the GDC software-only component that caused machines with long uptime to become randomly unresponsive has been resolved. The following issues have been resolved in this release of Google Distributed Cloud connected: The dataplane no longer refuses to forward traffic from secondary IPs after a cluster software upgrade. The Google Distributed Cloud connected dataplane no longer refuses to forward traffic from secondary IPs of virtual machines after the Google Distributed Cloud connected software has been upgraded, even if the affected virtual machine has the networking.gke.io/disable-source-ip-validation: "true" annotation in its configuration.
Identity-Aware Proxy - Identity-Aware Proxy (IAP) supports securing agent-to-anywhere egress for Agent Gateway. The feature generally available GA. To learn more about IAP support for Agent Gateway, see IAP for agents overview.
Looker - The full details on the release page.
Sensitive Data Protection - Between July 2025 and June 2026, some table data profiles saved to BigQuery contained an incorrect 1970-01-01 timestamp instead of NULL in expiration_time for tables that don't expire. This issue has been fixed. New exports of table data profiles show the correct expiration timestamps. Image scanning is available in the following cloud regions: asia-southeast1 us-east4 us-west1 For more information, see Locations that support image scanning. Image safety classification infoTypes are now supported in ExcludeByImageFindings and AdjustByImageFindings detection rules. For information about configuring these rules, see Modifying infoType detectors to refine scan results.
Service Mesh - The Envoy Lua Filter is now available as a preview feature in the rapid release channel. 1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-040. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev. 1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-040. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev. 1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh. This patch release contains the fix for the security vulnerability listed in GCP-2026-040. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev. The following images are now rolling out for managed Cloud Service Mesh: Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel. Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel. Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel. These patch releases contain the fix for the vulnerability listed in GCP-2026-040. These rollouts will preempt those previously announced on June 12, 2026.
VMware Engine - HCX upgrade to 4.11.4: The VMware Engine operations team is initiating updates of the HCX Manager Appliance to version 4.11.4. This upgrade resolves an issue with MON-enabled segments. You are responsible for upgrading the HCX On-Prem/Connectors and Service Mesh Appliances. For more details, see the Latest service announcements.
VPC Service Controls - General availability support for the following integration: Conversational Analytics API
Virtual Private Cloud - Preview: RoCE VPC networks for VM instances support assigning alias IP ranges to MRDMA vNICs. For more information about these features, see the following: RDMA network profiles Alias IP ranges General Availability: Service consumers can authorize Private Service Connect interfaces to connect to network attachments by adding service class IDs to a network attachment's accept list. For more information, see Authorization policies. General Availability: You can cancel pending deletion requests for VPC Network Peering connections that are in consensus mode. For more information, see Cancel a deletion request.