IBM & Red Hat launch Lightwell to fix open source flaws

IBM and Red Hat have launched Lightwell Clearinghouse, a service for businesses that want open source software dependencies reviewed and fixed. The companies also said the wider Lightwell initiative has remediated more than 400 previously unknown vulnerabilities in widely used Java libraries.

The launch adds a customer request channel to an initiative focused on finding and fixing flaws in open source components used in production systems. Customers can submit specific dependencies for priority review and receive fixes for older software versions that remain in use, IBM and Red Hat said.

The announcement comes as software security teams face a growing remediation challenge rather than a simple detection problem. Many tools can identify weaknesses in code and dependencies, but organisations still need patches that work with the versions running in live environments and can be introduced without disrupting operations.

Under the Lightwell model, engineers identify bugs in widely deployed Java libraries, develop remediations and backport fixes to supported older versions. The patched software is then delivered through secured repositories designed to fit into existing security scanners, software repositories, development pipelines and testing processes.

Focus on remediation

The approach reflects a broader shift in software security priorities. For large companies with extensive legacy estates, replacing vulnerable components is often difficult because applications depend on older packages that cannot be upgraded quickly without affecting stability or triggering fresh rounds of testing.

Lightwell is intended to close that gap by producing verified patches that customers can apply within established workflows, according to IBM and Red Hat. The companies added that applicable fixes are contributed back to upstream open source projects under responsible disclosure arrangements, allowing the wider ecosystem to benefit while preserving embargo protections for participating customers.

The two companies framed the milestone around changes in the threat environment driven by artificial intelligence. They argued that automated agents can chain together several low-severity weaknesses to create a more serious compromise, increasing the value of fixing defects that might previously have been treated as lower priority.

Lightwell combines engineering teams from both companies, open source community relationships, AI-assisted engineering workflows, and Red Hat's software supply chain and build infrastructure. IBM and Red Hat said that combination has helped the initiative uncover and remediate hundreds of previously unknown issues in mature codebases that remain heavily used across enterprise estates.

Java exposure

The emphasis on Java libraries points to many organisations' continued reliance on long-lived application stacks. Java remains deeply embedded in business systems across sectors including finance, telecommunications and healthcare, where software changes can be slow because of operational and regulatory requirements.

For those users, the ability to request a review of a specific dependency may offer a more direct route to remediation than waiting for community-led fixes or attempting to patch unsupported versions internally. The companies did not provide customer numbers, but presented general availability as a sign that the service is ready for broader enterprise use.

Gunnar Hellekson, Vice President and General Manager of Lightwell at Red Hat, described the rationale in direct terms. "AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together. Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime. Finding and neutralising 400+ novel vulnerabilities so quickly shows how fast Lightwell can move, and we are just getting started," Hellekson said.