IBM and Red Hat Fix 400+ Unknown Java Library Vulnerabilities via Lightwell

Fixing, not just finding, vulnerabilities

According to IBM and Red Hat, the work responds to a growing business risk: autonomous AI agents are becoming capable of combining several lower-risk software weaknesses into a more serious attack. In that environment, the companies argue, organizations need to do more than identify vulnerabilities. They need a practical way to develop, test and deploy fixes in software that supports critical applications.

The companies point out that many security tools can flag potential problems, but detection alone does not remove the risk. Fixes must work with the software versions already running in production and be introduced without disrupting business operations. Through Lightwell, Red Hat and IBM say they have uncovered, remediated and backported fixes for more than 400 previously unknown bugs in widely deployed, production-grade software.

IBM and Red Hat say the results show that even mature codebases need continued attention as threats evolve, and that they are focusing engineering resources on this foundational software to help reduce risk across enterprise systems.

How Lightwell works

Lightwell builds on the companies' commitment to secure open source software for the AI era. According to the announcement, it combines four capabilities:

• Open source engineering expertise from Red Hat and IBM
• Red Hat's open source community relationships
• Advanced AI-assisted engineering workflows
• Red Hat's secure software supply chain capabilities and build infrastructure

The companies say this combination develops version-specific fixes for open source application dependencies in production systems. Remediations are delivered through secured repositories that connect with customers' existing IT processes. Organizations can therefore address difficult or previously unknown vulnerabilities without replacing their current security scanners, software repositories, development pipelines or testing processes.

Through Lightwell Network, IT teams can access verified patches, bring remediated software into their existing workflows and set up an ongoing process for addressing vulnerabilities.

Lightwell Clearinghouse and upstream contributions

With Lightwell Clearinghouse now generally available, customers can submit specific open source vulnerabilities to IBM and Red Hat for priority review and remediation. The resulting fixes can be applied to older software versions that are still in use.

The companies also say applicable fixes developed through Lightwell are contributed back to upstream open source projects under responsible disclosure protocols. According to the announcement, this lets the broader open source ecosystem benefit while embargo protections are maintained for Clearinghouse participants.

Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat, framed the effort around speed. "AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed," he said. He added that finding bugs is "only half the battle" and that the real work is backporting fixes directly into active production apps so customers do not have to choose between security and uptime. Of the 400+ vulnerabilities, he said: "we are just getting started."

What it means for enterprise users

For enterprises that depend on open source Java libraries, the announcement points to a route for getting fixes into older, running software versions without overhauling their security tooling. Clearinghouse gives customers a direct way to ask for priority attention on specific dependencies. The figures and capabilities described come from IBM and Red Hat, and the release does not name the affected libraries or give details on pricing.