IBM and Red Hat said their Lightwell open-source security program has found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries, SiliconANGLE reported Tuesday. The companies also made Lightwell Clearinghouse generally available, a service through which enterprise customers can submit specific open-source dependencies for priority review and repair.

What Happened

Engineers from both companies paired AI-assisted development workflows with conventional security analysis to find the flaws, according to SiliconANGLE. The builds ran on Red Hat's secure software supply chain platform, and the patched packages are distributed through the Lightwell Network catalog.

IBM and Red Hat did not identify which Java libraries or projects were affected, and SiliconANGLE's report gave no severity ratings or CVE identifiers for the 400-plus bugs.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

The Clearinghouse turns that work into a request queue. A customer worried about a particular dependency can submit it, and Lightwell engineers review it ahead of the general catalog. Participants are covered by embargo protections while fixes move through responsible disclosure with the upstream open-source maintainers, and the fixes are then contributed back to those projects.

Why It Matters

The pitch rests on what happens after a bug is found. Gunnar Hellekson, Red Hat's vice president and general manager for Lightwell, told SiliconANGLE that "finding the bugs is only half the battle." The harder part, he argued, is getting fixes into applications already in production so customers are not forced to trade security for uptime.

That is why backporting is central to the offer. Many enterprises run older versions of Java libraries buried deep in dependency trees, and an upstream fix often lands only in the newest release. Lightwell applies the patches to the older, widely deployed versions so customers do not have to take on a major upgrade to close a hole.

The scale of the disclosure also reflects a broader shift. AI tools are now surfacing open-source vulnerabilities faster than many volunteer maintainers can triage them, and Hellekson described AI agents as having changed the threat picture by probing legacy dependencies at machine speed. Vendors such as IBM and Red Hat are positioning remediation and long-term maintenance, not just discovery, as the paid service.

How Lightwell Got Here

The program has expanded in steps over five months. In May, IBM and Red Hat committed $5 billion and more than 20,000 engineers to open-source security. In July they launched the Lightwell Network with more than 6,500 remediated dependencies and opened a premier tier of the Clearinghouse to financial services firms. In August they extended free access to universities, nongovernmental organizations and think tanks.

Tuesday's announcement widens the Clearinghouse beyond that financial services group to enterprise customers generally.

What to Watch

The names of the affected Java libraries should become clearer as embargoes lift and upstream projects publish advisories and releases. Security teams will be looking at how many of the 400-plus issues are serious enough to warrant CVE identifiers, and how quickly the fixes reach the public versions of those libraries rather than only the Lightwell catalog. Another open question is how maintainers respond to a large vendor feeding them a steady stream of AI-found bugs, and whether the review load on volunteer projects becomes a point of friction.