Loading story…
IBM and Red Hat have launched and expanded Lightwell, an AI-assisted open source security initiative aimed at helping enterprises secure software supply chains as AI-generated and AI-assisted code becomes more common. The platform combines software signing, provenance generation, artifact verification, policy validation, lifecycle management, and remediation services so organizations can verify how software was built, whether artifacts were altered, and whether releases comply with internal security requirements. IBM and Red Hat position Lightwell as a commercially supported implementation of supply-chain security practices including Sigstore, in-toto, SLSA, and SBOM-driven workflows.
The rollout includes Lightwell Network, which provides signed binaries, source code, compliance artifacts, and SBOMs, and Lightwell Clearinghouse Premier, initially offered in limited availability for the financial services sector with embargoed vulnerability coordination and version-targeted remediation. The companies said the services are designed to identify, validate, and remediate open source vulnerabilities at scale, including backporting critical fixes to long-lived production versions instead of requiring major upstream upgrades, as vendors race to counter AI-enabled attacks and strengthen trust in open source development.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
IBM and Red Hat announced an expansion of Lightwell with new commercial offerings focused on trusted and verifiable software supply chains. The expanded platform adds capabilities such as signing, provenance generation, artifact verification, policy validation, and lifecycle management, building on standards including Sigstore, in-toto, SLSA, and SBOM practices.
IBM and Red Hat announced Lightwell as an AI-assisted initiative to detect, validate, and remediate vulnerabilities in open source software at scale. The launch materialized as two offerings: Lightwell Network, broadly available, and Lightwell Clearinghouse Premier, entering limited availability for the financial services sector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
infoq.com
Open sourcezdnet.fr
Open sourceslsa.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux Foundation and a coalition of major technology and financial firms have launched **Akrites**, a new initiative designed to protect critical open-source software as AI accelerates vulnerability discovery and exploitation risks. Backers include Amazon Web Services, Anthropic, Cisco, Citi, Ericsson, Google, IBM, JPMorganChase, Microsoft, GitHub, Nvidia, OpenAI, Red Hat, and the Rust Foundation, reflecting broad industry concern over the security of widely used open-source components. Akrites is intended to streamline coordinated vulnerability disclosure and remediation by providing a shared security incident response capability for critical projects. The effort aims to reduce fragmented reporting, duplicate submissions, conflicting fixes, and pressure on already overburdened maintainers, while improving how serious flaws are disclosed and patched across the open-source ecosystem. Early reaction has framed the program as a significant step toward collective defense, though its effectiveness is expected to depend on scaling response capacity, avoiding centralized bottlenecks, and earning the trust of project maintainers.
Aug 19, 2026
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026
Software supply-chain compromise continued to blend into normal development activity, with attackers exploiting the speed and trust of modern workflows—third-party dependencies, automated updates, and rapid release cycles—to distribute malware and steal credentials. A ReversingLabs study covering 2025 open-source ecosystems reported **npm** as the dominant distribution channel for malicious packages, including incidents where attackers **compromised maintainer accounts** and shipped tainted updates that propagated quickly into downstream projects via routine dependency updates and CI/CD processes. One highlighted case was the **Shai-hulud** worm, described as a registry-native, self-propagating threat that used **stolen credentials** to inject malicious code into **hundreds of packages**, exposing **tens of thousands of downstream repositories** and complicating detection because it did not rely on external infrastructure. In parallel, commentary on generative AI’s impact on software delivery emphasized that faster code production and release pressure can increase security debt: reported industry claims that **20–30% of code** at major firms is AI-generated, alongside estimates that a large share of AI-generated code can introduce **OWASP Top 10**-class weaknesses, reinforcing the need for stronger testing and controls as development velocity increases.
Jun 29, 2026