IBM Corp. and its Red Hat unit said today that their Lightwell open-source security program has found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries.

The companies also made Lightwell Clearinghouse generally available. Enterprise customers can use it to submit specific open-source dependencies to IBM and Red Hat for priority review and remediation.

The milestone is pitched at a risk the two companies say is growing as autonomous artificial intelligence agents get better at chaining several lower-risk software weaknesses into one serious attack. Because many businesses still run library versions that are years old, any patch has to be built for the exact release sitting in production.

For the more than 400 flaws, Lightwell engineers backported patches into the widely deployed versions of each library. Any fix that also applies upstream goes back to the open-source project under responsible disclosure protocols while Clearinghouse participants keep their embargo protections. Neither company has named the affected libraries.

Behind the fixes, engineers from both companies work alongside AI-assisted development workflows, and the builds run on Red Hat’s secure software supply chain infrastructure. Customers pull the patched packages from secured repositories that connect to their existing information technology processes, so nobody has to swap out security scanners or development pipelines to use them.

Those patched packages come through Lightwell Network, the general catalog IT teams draw on to fold verified patches into the workflows they already have. Fixes that come back from a Clearinghouse request are built to apply to older software versions a customer still runs.

Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat, said AI agents “shifted the threat landscape overnight” by going after old dependencies at machine speed. Age and stability do not protect a codebase, he argued. Finding the bugs is “only half the battle,” Hellekson said, and the real work is backporting fixes into applications already in production so customers “do not have to pick between security and uptime.”

Lightwell dates backk to May, when IBM and Red Hat committed $5 billion and more than 20,000 engineers to securing open-source software. Lightwell Network went generally available in July with a launch catalog of more than 6,500 remediated dependencies, and a tier called Clearinghouse Premier opened to financial services companies on a limited basis at the same time. IBM and Red Hat extended Lightwell to universities, nongovernmental organizations and think tanks at no cost in August.

Image: Red Hat