en.Wedoany.com Reported - Red Hat has announced Project Lightwell, which combines AI and human expertise to accelerate the delivery of enterprise-grade open source software security patches, addressing increasingly severe supply chain security threats.
Red Hat CTO Chris Wright noted that open source software forms the foundation of modern technology with no viable alternative. Since 2016, the number of published CVEs has grown by over 520%. AI-driven scanning tools can identify critical zero-day vulnerabilities within hours, yet less than 1% of these are patched. The core challenge for enterprises lies in whether their operational capabilities can rapidly consume and deploy fixes.
Currently, major organizations rely on the same core open source packages, such as Spring Framework, Jackson, Log4j, Pandas, and OpenSSL, but lack coordination. They independently discover vulnerabilities and develop patches in isolation, resulting in significant redundant effort and inconsistent quality, leaving the broader ecosystem continuously exposed to risk.
Project Lightwell extends Red Hat's two-decade-old enterprise-grade security patch backporting methodology, applying this engineering discipline to application frameworks and dependencies above the operating system layer. Starting with Maven/Java, it will later expand to PyPI, npm, and others. The project uses AI to handle high-volume threat intake, combined with human engineering, to deliver precise fixes for exact stable versions running in enterprises, adhering to the upstream-first principle by contributing fixes back to the original open source communities.
This project represents a joint $5 billion commitment from Red Hat and IBM, backed by over 20,000 engineers, aimed at building an information exchange hub for software supply chain security. The network enables members to share vulnerability discoveries early and receive coordinated patches, with each fix cryptographically signed and accompanied by machine-readable SBOMs and security advisories to meet compliance requirements. Through Project Lightwell, the defensive capabilities of individual enterprises and the overall security level of the open source community are simultaneously enhanced.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
