Topic
Durable engines that own long-running execution state, timers and retries instead of application code.
CISA added Kestra's CVE-2026-49869 to its known-exploited catalog on September 2 at CVSS 10.0, after an auth-filter bug let unauthenticated callers run commands as root. Teams on affected Kestra OSS builds should upgrade to 1.0.45 or 1.3.21.
Reality
One ML team moved Airflow off on-prem boxes onto a single GCP VM estimated at under $150 a month, against about $350 for Cloud Composer 3. Its published repo gives other teams a working build to price against their own Composer quote.
Reality
One homelab operator's Temporal workflow polls GitHub every 30 seconds and dispatches one-job Nomad runners, retiring six idle per-repo runners. Each runner stays bound to one repo, but code now mints the tokens and capacity is reserved only while a job runs.
Reality
A reported $500mn round at $12bn pre-money values the workflow engine at roughly seven times its March 2025 mark. The revenue figure behind it is nine months old.
Reality
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
n8n went from $2.5bn to $5.2bn in seven months and SAP is embedding its canvas in Joule Studio, while the single number offered for agent failure, an 88% security incident rate, arrives without a population or a definition.
Reality
The posts show a two-process design: your app declares tasks with @Task, and a separate stateful scheduler cluster owns the schedule and enforces retry, timeout and misfire policy from outside your code.
Reality
An engineer who runs Camunda 8 in production priced the AWS alternative from its docs and found the billing unit is the state transition, so the same order costs more on the days its steps have to retry and roll back.
Reality
An unauthenticated POST to the Conductor Workflow API registers a definition whose inline expression evaluates in a GraalVM context with host access enabled, and the default image runs that process as root. Empirical Security logged attempts in August.
Reality
A devops.com SecMLOps experiment adds encrypted secrets, pattern-checked inputs and SHA-256 hashing to an Apache Airflow pipeline, then lets a final audit task decide whether the run counts as done.
Reality
The bypass is a suffix match inside Kestra's AuthenticationFilter, and the vendor fix pins the check to /api/v1/configs exactly. The two ZoomEye queries that count exposed instances disagree by nearly a factor of two.
Reality
A dual-orchestration pattern hands machine sagas to Temporal and human approvals to Flowable along BIAN service-domain lines. The retry policy in its Go sample shows what the machine side's latency budget really allows.
Reality
Temporal closed a $550 million round at a $12.55 billion valuation, roughly 50 times the revenue it reports. The product it sells exists to remember which step of a crashed job already ran.
Reality
Lightspeed co-led a $550 million Series E on September 14th, seven months after Temporal's $5 billion Series D. The operating metrics behind the markup are Temporal's own: 4,300 paying customers and 1.9 trillion billable actions in August.
Reality
Kestrel Workflows built durable execution out of Postgres row locks, constraints and leases, and published the schema that does it. The design keeps a second stateful system out of the path of every incident response.
Reality
Four years after shipping an orchestrator that wanted a Kafka cluster and an Elasticsearch cluster to schedule a job, Kestra has rebuilt the engine around that complaint, keeping the Apache 2.0 licence in place.
Reality
A dev.to walkthrough hands a seven-day onboarding flow to a workflow engine on port 7233. The install is two lines; the part that reshapes your code is the rule that the orchestrator may never touch Eloquent.
Reality