Red Hat's Lightwell has fixed more than 400 novel flaws in foundational Java libraries since June

Infosecurity Magazine's report gives no library names, CVE identifiers or severity ratings for the 400-plus fixes, and no word on whether any of the flaws was exploited or how many started as AI-generated reports ^[1]. On that record there is no patch deadline. The count comes from Red Hat.

The threat case comes from Gunnar Hellekson, Red Hat's VP and general manager of Lightwell. He said the emergence of AI agents "shifted the threat landscape overnight, exploiting old dependencies at machine speed." ^[6] "They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together," he said ^[7]. Red Hat says that reasoning is why it started Lightwell ^[7].

The detail on how fixes reach production is in Clearinghouse Premier, which IBM and Red Hat unveiled alongside Lightwell Network in July 2026 ^[9]. Premier is built for select enterprise customers running pinned versions in production ^[11]. A customer reports a flaw tied to a specific package and version. Red Hat triages it for severity and applicability, then writes a backport for that exact supported version ^[12]. The fix is then coordinated with the upstream project to confirm it is technically acceptable there ^[12]. Red Hat builds the package on its own infrastructure and signs and attests the output. The customer deploys that binary and skips reproducing the remediation and validation work ^[12].

"Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime," Hellekson said ^[8]. Red Hat said the fixes arrive through secured repositories, so customers can handle novel flaws without replacing their "current scanners, repositories, CI/CD pipelines or validation processes" ^[13].

The pressure behind the project is the volume of reports. According to Infosecurity Magazine, Red Hat and IBM were among the first to build processes for the influx of AI-powered vulnerability reports. Those processes validate genuine flaws and reduce the load that noisy or inaccurate submissions put on open-source maintainers ^[3]. The report treats this as a general change in how bugs reach maintainers, with no single exploit or actor attached. For a team pinned to an old Java library, the result is a steady supply of fixes to evaluate. They come from an engine designed to produce version-specific fixes for open-source dependencies already in production ^[14].