「Previously Unknown Open Source Vulnerabilities」 — 「Red Hat Remediate More Than 400」 — IBM and Red Hat Say Lightwell Fixed 400+ Open-Source Vulnerabilities; Clearinghouse Now Generally Available

On October 6, 2026, IBM and Red Hat said Lightwell had identified and remediated more than 400 previously unknown vulnerabilities in widely used Java libraries. The companies said the work also produced backported fixes for widely deployed, production-grade software, including versions that organizations may still be running.

The companies also announced that Lightwell Clearinghouse is generally available. Enterprise customers can submit specific open-source dependencies or vulnerabilities for priority review and remediation, including fixes applicable to older software versions. IBM and Red Hat say Lightwell delivers remediations through secured repositories that connect with existing IT processes, without requiring organizations to replace their current scanners, software repositories, development pipelines, or testing processes.

The announcement adds a new step to Lightwell’s rollout. In July, IBM and Red Hat announced the commercial launch of Lightwell, including Lightwell Network and a limited-availability offering called Lightwell Clearinghouse Premier. The newly announced general availability of Clearinghouse gives enterprises a formal route to request priority handling for specific dependencies or vulnerabilities. IBM and Red Hat say applicable fixes are contributed to upstream open-source projects under responsible disclosure protocols, while preserving embargo protections for Clearinghouse participants.