IBM and Red Hat said on October 6 that Lightwell, the open-source security program the two companies funded with $5 billion in May, has found, fixed, and backported patches for more than 400 previously unknown vulnerabilities in widely used Java libraries. The same announcement made Lightwell Clearinghouse generally available, so enterprise customers can now submit a specific open-source dependency to IBM and Red Hat for priority review and a fix that applies to the older version they are running in production.
The companies tie the 400 figure to a specific threat: autonomous AI agents that can chain several low-severity weaknesses in different libraries into one serious attack. Scanners typically flag those CVEs without supplying a fix that matches the exact library version in production, which leaves the risk in place. Lightwell’s answer is to have IBM and Red Hat engineers find the bugs, write version-specific patches, and backport them to the older dependency releases that enterprise applications still depend on.
“AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed,” said Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat. “They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together. Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime.”
AI-Assisted Backporting and Upstream Patch Disclosure Architecture
Pozzo di luce combines Red Hat and IBM open-source engineering, Red Hat’s community relationships, AI-assisted engineering workflows, and Red Hat’s secure software supply chain and build infrastructure. The output is a version-specific fix for a dependency as deployed, delivered through secured repositories that plug into the customer’s existing scanners, artifact repositories, CI/CD pipelines, and test processes, so nothing in the build chain has to be replaced to consume a patch.
The program has two customer-facing pieces, starting with Lightwell Network, where IT teams pull verified patches and set up an ongoing remediation process. Lightwell Clearinghouse, now generally available, is the request path: a customer names the open-source vulnerability or dependency it needs addressed, and IBM and Red Hat review it, remediate it, and produce a fix for the older version still in use. Where a fix applies upstream, it is contributed back to the open-source project under responsible disclosure, with embargo protection for Clearinghouse participants in the meantime.
Platform Availability and Upstream Delivery
Clearinghouse is available now; IBM and Red Hat have not published pricing or said which Lightwell tiers include it. The 400 vulnerabilities are described as spanning widely used, production-grade Java libraries, and the companies have not named the libraries or published CVE identifiers. Lightwell launched commercially in July, and partners have begun building services on it, including the LTM remediation practice we covered in September.
Amazon