# Red Hat and IBM launch Lightwell training for exact-version CVE remediation

> **Key takeaway:** Red Hat and IBM's Lightwell initiative now offers two training courses teaching enterprises how to apply surgically backported security fixes to pinned open-source dependencies without forcing upstream version upgrades.

**Published:** 2026-11-06T02:04:46.885586+00:00 
**Source:** Red Hat Blog 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/red-hat-and-ibm-launch-lightwell-training-for-exact-version-.html 

## Summary
Red Hat has introduced two new instructional lessons for Lightwell, a joint enterprise initiative with IBM that addresses the growing challenge of securing pinned open-source dependencies against disclosed vulnerabilities. The courses target both strategic decision-makers and technical practitioners, covering how to obtain exact-version, backported CVE fixes without the breaking changes that typically accompany upstream upgrades.

The first lesson, "Reduce Open-Source Remediation Burden with Lightwell," is aimed at CISOs and infrastructure leadership and explains the operational bind created by dependency pinning when critical vulnerabilities emerge. The second, "Implementing End-to-End Software Supply Chain Security with Remediated Open Source Dependencies," provides architectural and CI/CD integration guidance for DevOps engineers and security architects. Both are available immediately to Red Hat Learning Subscription Premium, Standard, and Trial subscribers at no additional cost.

## Lightwell's approach to dependency remediation
- **Exact-version backporting:** Lightwell delivers vulnerability fixes that are surgically backported to the specific pinned versions enterprises already run, rather than requiring upstream version bumps that could break applications or invalidate certifications.
- **CI/CD pipeline integration:** The second lesson provides architectural blueprints and operational strategies for integrating Lightwell's validated, attested fixes directly into existing build environments and software supply chain workflows.
- **Targeted audience split:** The curriculum separates strategic and technical tracks, with the first lesson addressing risk officers and infrastructure leadership and the second targeting DevSecOps practitioners and security architects.
- **Subscription access model:** Both lessons are accessible through Red Hat Learning Subscription tiers (Premium, Standard, and Trial) without additional fees, identified by course codes AD0023L and AD0024L.

## Why it matters
For enterprise Linux users and organizations with extensive Red Hat-based infrastructure, Lightwell represents a pragmatic alternative to the upgrade-or-accept-risk dilemma that has long plagued dependency management in regulated and stability-critical environments. The training availability signals that Red Hat and IBM are moving from concept to operational deployment of this remediation model, which could reduce the friction between security response velocity and production system stability that currently slows CVE response across the open-source software supply chain.