Red Hat OpenShift 5 Release and How AI is Changing the Game in Software Security
Red Hat has released version 5 of its enterprise application management platform OpenShift. This was the first major release in 7 years and had been previewed at last week’s analyst day event in Boston along with news on Red Hat’s work on AI and software security.
OpenShift is used to run and manage enterprise applications across data centers, clouds and edge locations, including containerized apps, virtual machines and AI. IBM, Red Hat’s parent company, noted on its latest earnings call that OpenShift is now generating $2.4 billion in annual recurring revenue, up more than 30% year over year.
AI Raises the Ceiling for Enterprise Management
To help make OpenShift easier to manage there are several new AI capabilities, including a new AI assistant that can investigate issues and recommend fixes for approval by administrators, an AI upgrade planner that can help identify compatibility issues with potential upgrades, and the ability to run AI agents to manage parts of the platform.
There are also new security features, including better separation between organizations within the platform and encryption that will be safe from potential future quantum computers. New major versions of the platform will now be released every three years, giving customers a predictable schedule for budgeting, compatibility testing, and planning upgrades.
How AI has Changed the Time to Exploit Software Security Flaws
According to the Zero Day Clock, which tracks the gap between a vulnerability being publicly disclosed and confirmed attacks using it, hackers took an average of more than two years to exploit a flaw in 2018. By 2025 this had fallen to about three weeks. Today it is around 10 hours. At the same time, Red Hat expects the number of publicly disclosed vulnerabilities (CVEs) across the industry to pass 100,000 this year, up from about 10,000 a year historically.
What is Red Hat Lightwell?
Building on OpenShift’s emphasis on predictable upgrades, Red Hat is also working to address security threats with less disruption to existing systems. As part of a $5 billion commitment by IBM and Red Hat to open source security, Lightwell provides security fixes for the open source software libraries companies build their applications on, such as widely used Java and Python components, in the versions they already run.
Enterprise software often relies on many open-source components, some maintained by small teams with limited resources to address vulnerabilities. In its first three months of operation, Lightwell has fixed over 1,240 flaws across more than 50,000 versions of open source software.
Participating financial institutions can access fixes at least two weeks before vulnerabilities are publicly disclosed. Banks are a logical starting point because extensive testing and regulatory requirements can delay software updates. Working with Lightwell partner Palo Alto Networks, for example, Red Hat helps banks implement interim protections within hours, reducing exposure to attacks while they test and deploy permanent fixes.
What’s Next for Red Hat?
Red Hat plans to expand Lightwell to more programming languages, such as JavaScript and Go, and to government, healthcare, and telecommunications. It is also working with NVIDIA so companies can run AI agents in protected spaces with limited access to other systems. New versions of Red Hat Enterprise Linux will check for tampering each time a machine starts, which matters most for systems running unattended in factories and other remote sites.
Industrial users were part of the story. Manufacturer Gates moved its virtual servers to OpenShift, gained 50% more computing capacity, and used it to run AI that spots faults on the factory floor. Palo Alto Networks noted that factories and medical devices often can’t be patched quickly because of uptime, safety, and regulatory rules, so blocking attacks while a fix is tested is especially valuable there.
VDC View
OpenShift 5 and Lightwell tackle a problem embedded and industrial vendors know well: software that stays in use for a decade or more, built on parts that may no longer be maintained. Banks have shown the demand is real. In industrial markets, the open questions are whether device makers know what open source software is in their products, and who will deliver the fixes, whether it be the operating system vendors, chip makers, software partners or the device makers themselves. Europe’s Cyber Resilience Act, which now requires companies selling connected products to report vulnerabilities, may force the answer. As attacks speed up, vendors will be judged less on how long they support a product and more on how fast they can fix it.
VDC will explore these questions in its upcoming 2026 IoT & Embedded Operating Systems, Containers & Virtualization report.
