Closing the remediation gap with Lightwell

Executive summary

In April 2026, Anthropic's Claude Mythos Preview became the 1st AI model to autonomously discover, validate, and develop exploits for zero-day software vulnerabilities. In fewer than 7 weeks of testing, Mythos surfaced more than 2,000 previously unknown vulnerabilities across every major operating system (OS) and web browser. In the Linux® kernel, the software that runs most of the world's servers, including telecom service provider core networks and cloud-native 5G infrastructure, the model autonomously found and chained together several vulnerabilities to escalate from ordinary user access to complete machine control, without any human steering.¹

For telecommunications service providers, this is not a distant risk. It is an immediate, structural threat that compounds the challenges chief information security officers (CISOs) and security teams already face: massive infrastructure, expanding attack surfaces, and a remediation pipeline that was already failing to keep pace with conventional vulnerability discovery.

The industry has responded. Project Glasswing brings AI-powered scanning to critical infrastructure organizations. The Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC) coordinates real-time threat intelligence among U.S. carriers. Regional initiatives from the GSMA Telecommunications Information Sharing and Analysis Centre (T-ISAC) to the European Telecommunications Information Sharing and Analysis Centre (ET-ISAC) strengthen cross-border awareness. These are important steps forward, but they share a fundamental limitation. They improve how fast the industry finds and communicates vulnerabilities, but they do not solve the harder problem of how fast those vulnerabilities are applied to production environments.

Lightwell addresses that gap directly. As a managed security subscription backed by IBM and Red Hat engineering, Lightwell provides signed, backported fixes for eligible third-party open source dependencies at the versions service providers are already running in production. Combined with Red Hat's infrastructure-layer security capabilities, Lightwell gives service providers a path to full-architecture vulnerability remediation from kernel to application.

The scale of AI-powered vulnerability discovery has no precedent. Within its 1st month of operation, Project Glasswing—Anthropic's consortium of defensive security partners using the Mythos model—surfaced 6,202 high- or critical-severity vulnerability findings across more than 1,000 open source projects. Independent verification conducted over a subset of these findings confirmed a 90.6% true positive rate.²

Those numbers alone would be significant. What makes them urgent is the remediation reality. Of approximately 23,000 discovered vulnerabilities, only about 75 were patched and documented in the 1st few months, according to Deutsche Telekom CSO Thomas Tschersich, who also noted that some software vendors and maintainers have asked Anthropic to slow down the rate of reporting because they physically cannot absorb fixes fast enough.³

The 2026 Verizon Data Breach Investigations Report (DBIR) confirms the pattern at the industry level. For the 1st time in its 19-year history, the DBIR found that vulnerability exploitation has overtaken credential theft and phishing as the top initial access vector for breaches, accounting for 31% of all incidents. The volume of vulnerability instances reached 527.3 million in 2025—an eightfold increase over 2022. Meanwhile, the median time to full patching worsened to 43 days, and the share of Cybersecurity and Infrastructure Security Agency (CISA)-known exploited vulnerabilities that were fully remediated dropped from 38% to 26%.⁴

Anthropic warned in June 2026 that other AI companies and developers would make equivalent offensive AI capabilities within 6 to 12 months. The window for service providers to prepare is narrow and closing.⁵

Why service providers are uniquely exposed

Telecommunications networks are among the most complex technology environments on the planet. They are also among the most targeted, and face a number of unique challenges.

Legacy infrastructure that predates modern security models. As Dave Harcourt, BT's Chief Security Authority, observed in 2024, much of the telecommunications infrastructure in operation today was designed in an era that never anticipated today's threat landscape.⁶ Service providers manage vast brownfield environments—decades of network elements, operating systems and protocols layered on top of each other through years of expansion, mergers, and technology transitions. More than 45% of discovered vulnerabilities in these environments remain unpatched after 12 months.⁴

An attack surface with few parallels in any industry. The service provider environment spans customer resource management (CRM) and billing systems, core network protocols such as SIP and Diameter, 5G service-based architecture application programming interfaces (APIs), routing and transport infrastructure, lawful-intercept systems, and millions of network devices. Much of this runs proprietary vendor software that service providers cannot independently audit or patch.

Systematic targeting by sophisticated threat actors. The Salt Typhoon campaign compromised at least 9 U.S. service providers, accessing lawful-intercept systems and call detail records for more than 1 million users.⁷ Dwell times of up to 2 years went undetected. In Singapore, the UNC3886 campaign breached all 4 national service providers, requiring an 11-month coordinated counter-operation.⁹ In Canada, a threat actor stole at least 700 TB of data from a major service provider.¹⁰ These are not isolated incidents—they reflect sustained, well-resourced campaigns specifically targeting telecommunications infrastructure.

Shared vendor dependency creates correlated risk. Service providers worldwide rely on a concentrated set of equipment vendors for radio access networks (RAN), as well as core and transport infrastructure. A vulnerability in one vendor's software affects multiple service providers simultaneously. Interconnection between carriers adds a 2nd dimension of correlated risk: in discussing why the industry formed C2 ISAC, T-Mobile cybersecurity lead Mark Clancy noted that in cases such as SIM box fraud, one operator may identify the device on its network while the command-and-control server sits on another carrier's infrastructure—requiring carriers to investigate both sides together.¹¹

Current defenses: Strong progress with a critical gap

The industry has not been standing still. Three major initiatives have emerged in direct response to the evolving threat landscape. Each delivers real value, and each leaves a specific gap unaddressed.

Project Glasswing gives participating organizations access to Mythos for proactive vulnerability scanning. More than 200 organizations across 15 countries have joined, including service providers such as Verizon, AT&T, and BT. Glasswing has already surfaced thousands of critical findings in open source projects that underpin service provider infrastructure. But its reach has limits. Nokia, Ericsson, and other major network equipment providers (NEPs) are not members. The proprietary software that runs on RAN, core, and transport equipment, which forms the actual backbone of service provider networks, is not being scanned. Service providers cannot independently audit or patch this code. The remediation cycle remains entirely dependent on vendor timelines.

C2 ISAC brings the CISOs of 8 major U.S. service providers together for real-time, private-sector-only intelligence sharing. It fills a critical coordination gap, allowing them to share indicators of compromise, attacker techniques, and mitigation playbooks at operational speed. Early results include cross-service provider subscriber identity module (SIM) box detection techniques and coordinated responses to residential proxy networks. But C2 ISAC is currently U.S.-focused with no international service provider members, and no NEP vendors or operational support system/business support system (OSS/BSS) vendors participate. It is an intelligence-sharing mechanism, not a remediation engine.

Regional ISACs and frameworks, including GSMA T-ISAC (global), ET-ISAC (Europe), ICT-ISAC (Japan), and others, add layers of awareness, regulatory alignment and cross-border cooperation. Europe's ET-ISAC runs biweekly computer emergency response team-security operations center (CERT-SOC) threat intelligence calls and an annual security benchmark. GSMA T-ISAC includes vendors alongside service providers, which C2 ISAC currently does not. These are valuable structures for visibility and preparedness. But none of them deliver patches.

The commonality across all 3 is an improvement in how quickly the industry sees and shares threat information. However, these initiatives do not accelerate how quickly vulnerabilities are actually fixed.

Deutsche Telekom's Tschersich identified the core issue in a direct response to the Glasswing findings: "AI finds vulnerabilities faster than ever. But faster finding does not mean faster fixing. Every day saved in patching counts."³ 

The remediation crisis: Where the real risk lives

The data is clear. The industry's primary security challenge has shifted from detection to remediation.

90% of enterprise application code consists of open source or third-party dependencies. The average open source codebase audited by Black Duck now carries 581 known vulnerabilities—a number that doubled in a single year.¹² The mean time to exploit has moved to negative 7 days, meaning attackers are routinely exploiting vulnerabilities a full week before patches become available.¹³

Current remediation approaches cannot keep pace. When a scanning tool flags a critical common vulnerability and exposure (CVE) in a transitive open source dependency, the typical response requires developers to investigate, pull a new version of the package, rebuild the application, test for breaking changes, and often rewrite code to accommodate the new version. In regulated environments, where service providers must maintain tested and certified software configurations, forced version upgrades can trigger full recertification cycles.

Scanning tools do important work. They tell security teams where the problems are. But they do not fix them. The output of a scanner is a dashboard of findings. The gap between that dashboard and a patched, signed, production-ready artifact is where risk accumulates.

Internal workarounds that involve forking packages to patch vulnerabilities manually, accepting risk backlogs, and delaying upgrades to preserve stability create their own problems. Every internal fork diverges from upstream, creating permanent maintenance burdens. Risk backlogs grow into audit failures. Delayed upgrades compound technical debt. None of these approaches scale when AI generates thousands of vulnerability findings every month.

Lightwell is a managed security subscription from Red Hat and IBM that helps organizations address the hardest problem in open source security: Remediating vulnerabilities without breaking production. Lightwell helps tackle this issue in a number of ways:

Backported patches at pinned versions. When a vulnerability is found in an eligible third-party open source dependency, Lightwell provides access to a remediated artifact at the specific version a service provider is already running. There are no forced upgrades, no changes to application code, and no regression risks. For regulated organizations that must maintain tested and certified configurations, this approach removes the trade-off between security compliance and operational stability.

From network access to deeper collaboration. Lightwell is available in 2 paths. Lightwell Network, generally available since July 8, 2026, provides access to available remediation streams and supporting security artifacts for eligible dependencies. For service providers that need deeper coordination, the Lightwell Clearinghouse Premier model—currently available on a limited basis—supports customer-specific vulnerability prioritization, coordinated early disclosure capabilities, and defined remediation timelines. The purpose of the clearinghouse model is to reduce the duplication that arises when every organization independently scans, triages, and patches the same vulnerabilities. The clearinghouse instead helps coordinate remediation that benefits all participants.

Supporting compliance documentation. Lightwell artifacts ship with supporting security metadata, including CycloneDX Software Bill of Materials (SBOM), Vulnerability Exploitability eXchange (VEX) advisories, Supply Chain Levels for Software Artifacts (SLSA) Level 3 build integrity, and cryptographic signing where applicable. For service providers navigating the EU’s Network and Information Security Directive (NIS2), Cyber Resilience Act (CRA), and Digital Operational Resilience Act (DORA), along with other regulatory mandates, these artifacts can help address compliance documentation needs, as they are generated with the package rather than assembled manually after the fact.

Simple integration. Lightwell plugs into existing build infrastructure through a single configuration change. Service providers point their existing artifact repositories, like Artifactory, Nexus, and Maven, to Red Hat's registry. With this approach, there is no rip-and-replace, and no new continuous integration and continuous delivery (CI/CD) tooling is required.

Engineering depth at scale. Red Hat and IBM dedicate engineers who co-maintain many of the upstream open source projects relevant to Lightwell. Fixes are not only backported; they are contributed upstream for the broader community to benefit. Service providers can upgrade without reintroducing the same vulnerabilities. AI-powered triage extends the reach of human expertise across the full volume of AI-generated findings.

Full-stack security: From kernel to application

Lightwell extends a service that Red Hat is already delivering at the infrastructure layer.

Red Hat's response to AI-accelerated vulnerability discovery operates at 2 distinct levels that service providers need together.

Infrastructure layer (available to all Red Hat customers). Red Hat Lightspeed identifies vulnerabilities across Red Hat® Enterprise Linux, Red Hat OpenShift®, and system-level packages. Red Hat Satellite manages content, errata, and lifecycle environments. Red Hat Ansible® Automation Platform supports event-driven remediation at scale, and automatically applies patches, enforcing configurations and closing the loop from detection to fix across the OS and platform.

Application dependency layer (Lightwell). The open source libraries embedded in service provider applications sit above the OS. A service provider that patches Red Hat Enterprise Linux flawlessly can still be exploited through an unpatched vulnerability in Spring Framework, Log4j, or any of the thousands of dependencies in an OSS/BSS application. Lightwell closes this gap with remediation for applications written in languages like Java, Python, JavaScript, and .NET, with more languages and platforms being added as part of a planned expansion.

Together, these 2 layers give service providers consistent remediation coverage extending from the kernel to eligible application dependencies. This approach connects directly to the common cloud-native platform and automation capabilities that many service providers already use with Red Hat, extending the same operational model to a domain that has historically been unmanaged.

The shift from detection-led to remediation-led security is not optional. The data shows why it’s mandatory: Vulnerability volumes are growing exponentially, remediation rates are declining, and the exploitation window is shrinking below zero. Every day saved in patching reduces exposure. A service provider CISO should:

Assess remediation velocity. Measure the actual time from vulnerability detection to patched artifact in production at both the infrastructure layer and the application dependency layer. If the numbers are measured in weeks or months, the gap is widening faster than the industry average.

Map your open source dependency exposure. Understand how many open source components are embedded in your application supply chain and which of them sit outside the coverage of your current platform patching. If the answer is "we don't know," that is itself a finding.

Evaluate CI/CD readiness for automated remediation. Lightwell's value depends on a service provider's ability to use remediated artifacts, rebuild, test, and redeploy within a reasonable window. Service providers with mature DevSecOps and CI/CD pipelines will realize the fastest return. Those without should prioritize building that foundation. As the Lightwell program expands availability and coverage, early preparation positions service providers to move quickly when the service becomes available in their region.

Strengthen the full architecture. Connect your infrastructure-layer remediation (Red Hat Enterprise Linux, Satellite, Ansible Automation Platform) with your application-layer remediation strategy to eliminate the gap between a patched OS and unpatched application dependencies.

Get started with the Red Hat Consulting Secured Platform and Pipeline Velocity Assessment. This engagement is tailored to help you assess, map, and evaluate your environment so that the transformation to a strengthened architecture is efficient, not disruptive. Red Hat Services Accelerator for Lightwell gives you the flexibility to deploy experts where they are needed most, accelerating remediation, scaling security automation, and standardizing resilient platforms across your estate.

Contact your Red Hat representative to schedule a meeting of the experts.