IBM and Red Hat announced that their Lightwell initiative has identified and fixed more than 400 previously unknown security issues in widely used Java libraries. This effort is part of a larger commitment to invest $5 billion in improving the security of open source software. The announcement was made on October 6, 2026, alongside the launch of Lightwell Clearinghouse, a service that allows companies to submit specific open source software components for priority security checks and fixes. The companies emphasized that fixing these vulnerabilities in critical Java libraries is a major step toward addressing the growing threats to open source software supply chains. Lightwell aims to make the detection and correction of security issues more efficient, especially by backporting fixes to older software versions that are still in use in many production environments. This method helps companies address security flaws without having to upgrade to newer versions, which can be expensive and technically challenging. Lightwell Clearinghouse provides a platform for companies to submit their specific software dependencies or vulnerabilities for review and prioritized fixes tailored to the older versions they rely on. The service operates on an annual subscription model with two tiers: Lightwell Network offers access to verified fixes and corrected software that can be integrated into existing workflows, while Lightwell Clearinghouse provides more customized processing. Free access is also available to select American universities, NGOs, and think tanks. The initiative combines the open source engineering skills of IBM and Red Hat with AI tools and a team of over 20,000 engineers. Lightwell includes a "trusted enterprise information exchange center," where advanced AI monitors and verifies patches across a large portion of the open source ecosystem. Participating companies can use a confidential channel to report security issues, access ready-made patches developed and tested by IBM and Red Hat engineers, and contribute these solutions back to the broader open source community. Gunnar Hellekson of Red Hat said that Lightwell is "only just beginning" after addressing more than 400 Java vulnerabilities. He noted that identifying bugs is only part of the challenge—the other is ensuring that customers don’t have to choose between security and system availability. The slow and costly process of backporting fixes is something Lightwell aims to streamline and scale. Lightwell has created an initial catalog of more than 6,500 fixed dependencies, digitally signed and certified for use in Java and Python ecosystems. The goal is to expand from thousands to potentially millions of packages. The Clearinghouse adds another layer by allowing companies to submit their own dependencies for review and tailored fixes for the older versions they still use. The initiative positions itself as a maintenance infrastructure that distributes fixes through secure repositories, allowing companies to keep their existing tools and processes intact. The business model is based on pooling high engineering costs and offering them to companies that cannot afford to handle such tasks internally.