News · Red Hat Security Blog
-
Red Hat Security Blog
A patch only reduces risk when it runs in production
The patch was ready in days. It took months to ship. Why?I hear that question in nearly every customer conversation about vulnerability management. The honest answer is rarely “We didn’t know about it.” It’s “We knew, but getting it into production took longer than the exploit window.”That delay, the time between a patch’s release and it actually running in production across every exposed application, is one of the most overlooked metrics in managing enterprise risk. AI is collapsing time-to-exploit into hours, while many organizations still take 40 to 90 days to rebuild, validat
-
Red Hat Security Blog
Open Source Security Signals | Q3 2026
Vulnerabilities are easy to count. Meaningful risk is harder to measure.Open source has become the foundation of modern software because it works. Shared innovation, transparent development, global communities, and broad reuse let software advance at a scale no single organization could achieve alone.Security is part of that model. Open source development makes code available for inspection. Researchers can test it. Communities can improve it. Fixes can benefit everyone who depends on the software.The scale that makes open source powerful also makes security more complex. Modern applications c
-
Red Hat Security Blog
What’s old is new: Lightwell discovers novel zero-day vulnerability in core Java framework
Enterprise IT runs on decades-old foundational code. The prevailing assumption around these mature components is that if code has been sitting untouched in production for ten years without breaking, it must be safe. Libraries like the Eclipse Implementation of Jakarta XML Binding (JAXB) quietly power enterprise applications in the background. Embedded deep into middleware stacks and application servers, they carry heavy workloads without drawing attention.Advanced AI security tooling doesn’t ignore these deep-stack layers, however. It finds zero-day flaws hidden in structural parsing logic t
-
Red Hat Security Blog
Why "secure by design" is the new standard for open source
Open source software faces significant regulatory shifts, making "secure by design" development practices increasingly important. The Cyber Resilience Act (CRA) takes effect on December 11, 2027, and as of September 11, 2026, the first CRA vulnerability and incident reporting obligations were live. These new cybersecurity regulations impact all companies that sell software or hardware to the European market and will have a huge impact on open source as a whole.The readiness gap and the cost of inactionDespite the looming deadline, the software industry remains unprepared. According to The Linu
-
Red Hat Security Blog
Using on-premise Red Hat Lightspeed capabilities to monitor vulnerabilities and apply advisor remediations
Managing vulnerabilities across a fleet of Red Hat Enterprise Linux (RHEL) systems is a continuous challenge. Between tracking Common Vulnerabilities and Exposures (CVEs), prioritizing by business risk, planning RHEL upgrades, and remediating issues, operations teams juggle multiple tools and workflows daily. Red Hat Lightspeed brings a greater level of situational awareness into your on-premise environment to help you discover, prioritize, and fix security and other issues, without your system data ever leaving your network.In a previous blog post we’ve outlined how to install Red Hat Light
-
Red Hat Security Blog
Zero CVEs at delivery: Why container security belongs in the supply chain
Back in 2010, I wrote a small web tool to generate random galactic sectors for a tabletop role playing game. It started as a Perl application, but these days it’s a single, static Go binary with all of its assets compiled right into the executable. Thousands of game masters have used it, it runs quietly in the public cloud, and for years I rarely touched it.Like thousands of community tools across the open source ecosystem, my app seems pretty harmless. But harmless code running on top of an unmaintained container image is an open door. The moment you push an image to a registry and walk awa
-
Red Hat Security Blog
What enterprises need to know about the Cyber Resilience Act and software supply chain risk
In part 1 of this series, we examined why enterprises need more than an inventory of the open source components in their software. Understanding where dependencies come from, whether they are maintained, how they handle vulnerabilities, and what options exist when problems emerge is increasingly important to managing software supply chain risk.The European Union’s Cyber Resilience Act (CRA) brings this broader lifecycle perspective into sharper focus for organizations that manufacture or place products with digital elements on the EU market. The CRA requires manufacturers to address cybersec
-
Red Hat Security Blog
What enterprises need to know about the software they depend on
Knowing an application contains open source components is not the same as understanding the software and communities behind them.For many organizations, the software supply chain extends across thousands of dependencies, developed and maintained by communities, foundations, vendors, and individual contributors. Red Hat Chief Technology Officer Chris Wright described this as the enterprise software fabric: a shared network where developers from different companies, projects, and communities build and maintain code together.That collaboration is one of open source's greatest strengths. It allows
-
Red Hat Security Blog
Securing AI agents requires securing the systems around them
Enterprise AI is changing from software that primarily generates information to software that can take action. AI agents can call APIs, invoke tools, access files and credentials, communicate over networks and interact directly with business systems. That capability is useful precisely because it gives agents more reach and more authority. It also changes what enterprises need to secure.Model safeguards remain important, but they cannot carry the entire security burden. Once an agent can act on enterprise systems, security must extend beyond what the model is instructed to do. Organizations al
-
Red Hat Security Blog
Red Hat Enterprise Linux 10 STIG automation now matches DISA STIG V1R2
For the U.S. Department of Defense (DoD) and its contractors, security has to hold up against a published baseline—not a general claim that systems are “secure.” The Defense Information Systems Agency (DISA) defines that baseline in Security Technical Implementation Guides (STIGs), and STIG compliance is required for information systems that connect to DoD networks.In March 2026, the Defense Information Systems Agency (DISA) published a Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux (RHEL) 10. The scap-security-guide version 0.1.82 STIG profile is now availab
-
Red Hat Security Blog
2026 update: The road to quantum-safe cryptography in Red Hat OpenShift
A year ago, I wrote about the road to quantum-safe cryptography in Red Hat OpenShift. At the time, much of that road was forward-looking: TLS 1.3 was not yet the default, Go did not support post-quantum algorithms, and the first NIST post-quantum cryptography (PQC) standards had only just been finalized. A lot has changed. This update covers where we are today, what shipped, what is next, and, critically, why digital signatures (ML-DSA) are the harder half of the quantum-safe migration.What shipped: ML-KEM is in productionRed Hat OpenShift 4.22 ships ML-KEM (FIPS 203) by default. When a capabl
-
Red Hat Security Blog
Turning security complexity into useful intelligence: What’s new in Red Hat Lightspeed
In a post-Mythos world, IT teams face a mounting crisis. Many are doing more with the same staff, and security work hasn’t gotten simpler. Alerts still land without context. Compliance still means chasing down answers across tools. A single incident can consume an afternoon before anyone knows the real risk.To help teams move from static notification to proactive execution, Red Hat Lightspeed now delivers a series of updates to bridge the skills gap, break down operational barriers, and simplify security at scale.From cryptic data to immediate, confident actionThe cybersecurity skills gap me