IBM (NYSE: IBM) and Red Hat announced that their Lightwell initiative has identified and remediated more than 400 previously unknown vulnerabilities in widely used Java libraries, according to a company press release.

The companies also announced the general availability of Lightwell Clearinghouse, a service that allows enterprise customers to submit specific open source software dependencies for priority review and remediation, including fixes that can be applied to older software versions still in production.

The vulnerabilities were found in production-grade software, and fixes were backported to work with software versions already running in enterprise environments. Red Hat and IBM said the remediations are delivered through secured repositories that connect with customers' existing IT processes, allowing organizations to apply fixes without replacing current security scanners, software repositories, development pipelines, or testing processes.

Applicable fixes developed through Lightwell are contributed back to upstream open source projects under responsible disclosure protocols, the companies said.

Gunnar Hellekson, vice president and general manager of Lightwell at Red Hat, said in a statement: "AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together. Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime."

Lightwell combines open source engineering from Red Hat and IBM, AI-assisted engineering workflows, and Red Hat's software supply chain capabilities. Through its Lightwell Network component, IT teams can access verified patches and integrate them into existing workflows.