--- description: IBM and Red Hat say Lightwell has fixed 400+ previously unknown Java library bugs, and Lightwell Clearinghouse is now generally available. title: Lightwell Has Fixed 400 Previously Unknown Java Vulnerabilities as IBM and Red Hat Open Clearinghouse for Priority Patches image: https://www.storagereview.com/wp-content/uploads/2026/05/Storagereview-IBM-Red-Hat-Lightwell.png --- [![Storage Review]()](https://storagereview.com/) --- [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [![StorageReview.com]()](https://www.storagereview.com) ≡ Menu - [Home](https://www.storagereview.com/) - [Storage Reviews](https://www.storagereview.com/review) - [End User Reviews](https://www.storagereview.com/consumer) - [Enterprise Reviews](https://www.storagereview.com/enterprise) - [Ubiquiti Reviews](https://www.storagereview.com/best/ubiquiti-reviews) - [SR Merch](https://store.storagereview.com) - [Leaderboards](https://www.storagereview.com/best) - [Best Storage Arrays](https://www.storagereview.com/best/storage-arrays) - [Best Enterprise SSDs](https://www.storagereview.com/best/enterprise-ssds) - [Best Servers](https://www.storagereview.com/best/servers) - [Best Enterprise GPUs](https://www.storagereview.com/best/enterprise-gpus) - [Best Desktops for Local AI](https://www.storagereview.com/best/desktops-local-ai) - [Best Laptops for Local AI](https://www.storagereview.com/best/laptops-local-ai) - [Best Local LLM Tools](https://www.storagereview.com/best/local-llm-tools) - [Agentic AI Hardware](https://www.storagereview.com/best/agentic-ai-hardware) - [Best SSDs & Hard Drives](https://www.storagereview.com/best_drives) - [Best Portable SSDs](https://www.storagereview.com/best/portable-ssds) - [Best Business Laptops](https://www.storagereview.com/best/business-laptops) - [Best Mobile Workstations](https://www.storagereview.com/best/mobile-workstations) - [Best Desktop Workstations](https://www.storagereview.com/best/desktop-workstations) - [Best Mini PCs](https://www.storagereview.com/best/mini-pcs) - [Best Laptop Battery Life](https://www.storagereview.com/best/laptop-battery-life) - [Storage Reference Guide](https://www.storagereview.com/storage-reference-guide) - [About SR](https://www.storagereview.com/about-storagereview) - [StorageReview.com Sweepstakes Rules and Regulations](https://www.storagereview.com/storagereview-com-sweepstakes-rules-and-regulations) Search [Home](https://www.storagereview.com/) » [News](https://www.storagereview.com/news) » Lightwell Has Fixed 400 Previously Unknown Java Vulnerabilities as IBM and Red Hat Open Clearinghouse for Priority Patches # Lightwell Has Fixed 400 Previously Unknown Java Vulnerabilities as IBM and Red Hat Open Clearinghouse for Priority Patches by Harold Fritts on October 13, 2026 [Data Protection](https://www.storagereview.com/enterprise/data-protection)  ◇  [Enterprise](https://www.storagereview.com/enterprise) IBM and Red Hat said on October 6 that Lightwell, the open-source security program the two companies funded with $5 billion in May, has found, fixed, and backported patches for more than 400 previously unknown vulnerabilities in widely used Java libraries. The same announcement made Lightwell Clearinghouse generally available, so enterprise customers can now submit a specific open-source dependency to IBM and Red Hat for priority review and a fix that applies to the older version they are running in production. ![IBM and Red Hat Project Lightwell graphic with blue data streams crossing through a central envelope-shaped node]() The companies tie the 400 figure to a specific threat: autonomous AI agents that can chain several low-severity weaknesses in different libraries into one serious attack. Scanners typically flag those CVEs without supplying a fix that matches the exact library version in production, which leaves the risk in place. Lightwell’s answer is to have IBM and Red Hat engineers find the bugs, write version-specific patches, and backport them to the older dependency releases that enterprise applications still depend on. “AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed,” said Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat. “They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together. Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime.” ## AI-Assisted Backporting and Upstream Patch Disclosure Architecture [Lightwell](https://www.storagereview.com/news/ibm-and-red-hat-launch-5b-project-lightwell-join-anthropics-project-glasswing) combines Red Hat and IBM open-source engineering, Red Hat’s community relationships, AI-assisted engineering workflows, and Red Hat’s secure software supply chain and build infrastructure. The output is a version-specific fix for a dependency as deployed, delivered through secured repositories that plug into the customer’s existing scanners, artifact repositories, CI/CD pipelines, and test processes, so nothing in the build chain has to be replaced to consume a patch. The program has two customer-facing pieces, starting with Lightwell Network, where IT teams pull verified patches and set up an ongoing remediation process. Lightwell Clearinghouse, now generally available, is the request path: a customer names the open-source vulnerability or dependency it needs addressed, and IBM and Red Hat review it, remediate it, and produce a fix for the older version still in use. Where a fix applies upstream, it is contributed back to the open-source project under responsible disclosure, with embargo protection for Clearinghouse participants in the meantime. ## Platform Availability and Upstream Delivery Clearinghouse is available now; IBM and Red Hat have not published pricing or said which Lightwell tiers include it. The 400 vulnerabilities are described as spanning widely used, production-grade Java libraries, and the companies have not named the libraries or published CVE identifiers. Lightwell launched commercially in July, and partners have begun building services on it, including the [LTM remediation practice](https://www.storagereview.com/news/ltm-builds-a-lightwell-remediation-services-practice-around-ibm-and-red-hats-5b-open-source-program) we covered in September. ### [IBM and Red Hat Lightwell](https://www.redhat.com/en/lightwell) **Engage with StorageReview** [Newsletter](https://www.storagereview.com/storage_newsletter) |  [YouTube](https://www.youtube.com/user/StorageReview "Opens in a new window") | Podcast  [iTunes](https://podcasts.apple.com/gb/podcast/storagereview-com-storage-reviews/id1060681115 "Opens in a new window")/ [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0 "Opens in a new window") |  [Instagram](https://www.instagram.com/storagereview/ "Opens in a new window") |  [Twitter](https://twitter.com/storagereview "Opens in a new window") |  [TikTok](https://www.tiktok.com/@storagereview? "Opens in a new window") |  [RSS Feed](https://www.storagereview.com/rss.xml) ![]() ### Harold Fritts I have been in the tech industry since IBM created Selectric. My background, though, is writing. So I decided to get out of the pre-sales biz and return to my roots, doing a bit of writing but still being involved in technology. Previous post: [Marvell Structera X 3406 and 3506 Put Six DDR4 or DDR5 Channels and Four Hosts on One CXL 3.2 Expander](https://www.storagereview.com/news/marvell-structera-x-3406-3506-six-channel-cxl-3-2-memory-expander) Next post: [MSI OCP 2026: Four Liquid-Cooled CG681-S6093 MGX Servers Put Up to 32 RTX PRO 6000 GPUs in One 48RU Rack](https://www.storagereview.com/news/msi-ocp-2026-liquid-cooled-cg681-s6093-mgx-rack-32-rtx-pro-6000) Trusted Vendors Products and solutions from our affiliate partners: - [ ![Ubiquiti Logo]() Ubiquiti ](https://store.ui.com/us/en?a_aid=StorageReview "Opens in a new window") - [ ![Newegg Logo]() Newegg ](https://click.linksynergy.com/fs-bin/click?id=g5terNMDhz0&offerid=1207190.18&subid=0&type=4 "Opens in a new window") - [ ![Amazon Logo]() Amazon ](https://amzn.to/4fLJUEW "Opens in a new window") Newsletter Subscribe to the StorageReview newsletter to stay up to date on the latest news and reviews. We promise no spam! 1 Leave this field empty if you’re human: ## Advertisement Content Categories [Facebook](https://www.facebook.com/@storagereview) [X](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) Copyright © 1998-2025 Flying Pig Ventures, LLC Cincinnati, Ohio. All rights reserved. Manage your privacy To provide the best experiences, we and our partners use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us and our partners to process personal data such as browsing behavior or unique IDs on this site and show (non-) personalized ads. Not consenting or withdrawing consent, may adversely affect certain features and functions. Click below to consent to the above or make granular choices. Your choices will be applied to this site only. You can change your settings at any time, including withdrawing your consent, by using the toggles on the Cookie Policy, or by clicking on the manage consent button at the bottom of the screen. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Special features Special purposes Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage your privacy To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Special features Special purposes Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage consent Manage consent ```json {"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available","url":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available","name":"Lightwell Has Fixed 400 Previously Unknown Java Vulnerabilities as IBM and Red Hat Open Clearinghouse for Priority Patches - StorageReview.com","isPartOf":{"@id":"https:\/\/www.storagereview.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available#primaryimage"},"image":{"@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available#primaryimage"},"thumbnailUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/05\/Storagereview-IBM-Red-Hat-Lightwell.png","datePublished":"2026-10-13T14:48:31+00:00","description":"IBM and Red Hat say Lightwell has fixed 400+ previously unknown Java library bugs, and Lightwell Clearinghouse is now generally available.","breadcrumb":{"@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available#primaryimage","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/05\/Storagereview-IBM-Red-Hat-Lightwell.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/05\/Storagereview-IBM-Red-Hat-Lightwell.png","width":1920,"height":720,"caption":"IBM and Red Hat Project Lightwell graphic with blue data streams crossing through a central envelope-shaped node"},{"@type":"BreadcrumbList","@id":"https:\/\/www.storagereview.com\/news\/lightwell-400-java-vulnerabilities-clearinghouse-generally-available#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.storagereview.com\/"},{"@type":"ListItem","position":2,"name":"News","item":"https:\/\/www.storagereview.com\/news"},{"@type":"ListItem","position":3,"name":"Lightwell Has Fixed 400 Previously Unknown Java Vulnerabilities as IBM and Red Hat Open Clearinghouse for Priority Patches"}]},{"@type":"WebSite","@id":"https:\/\/www.storagereview.com\/#website","url":"https:\/\/www.storagereview.com\/","name":"StorageReview.com","description":"StorageReview.com is a leading provider of news and reviews throughout the entire IT stack - from the datacenter to the edge, and all points in between.","publisher":{"@id":"https:\/\/www.storagereview.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.storagereview.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.storagereview.com\/#organization","name":"StorageReview.com","url":"https:\/\/www.storagereview.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","width":344,"height":61,"caption":"StorageReview.com"},"image":{"@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/storagereview","http:\/\/youtube.com\/user\/storagereview"]}]} ```