IBM, Red Hat and Palo Alto Networks are integrating Palo Alto’s network-based virtual patching in Prisma with IBM/Red Hat’s Project Lightwell to spot and shield against open-source software flaws. The joint effort uses shared vulnerability intelligence and AI-driven processes to deliver preemptive, same-day network protections while patches are developed.

• IBM/Red Hat's Project Lightwell now feeds vulnerability intelligence into Palo Alto's Prisma so virtual patches can deploy the same day a flaw is confirmed, shrinking the discovery-to-defense window from weeks to minutes.
• The integration sits under IBM and Red Hat's $5 billion Project Lighthouse, with Lightwell acting as an AI-driven clearinghouse that validates and tests fixes across massive volumes of open-source code before delivering them via subscription.
• Early adopters include major banks and financial firms (Bank of America, Citi, Goldman Sachs, JPMorgan Chase, Mastercard, Visa), gaining preemptive protection across open-source libraries, commercial apps, OT and IoT environments.
• This builds on existing IBM-Palo Alto collaboration on quantum-safe readiness and AI risk assessment, adding network-level virtual patching as a stopgap while permanent fixes are developed.

Quodeq is an MIT-licensed tool that runs locally to scan codebases using AI across six ISO 25010 dimensions, mapping each finding to CWE identifiers and providing fix plans. It supports cloud and local models, outputs grades and violations in JSON, and includes a dashboard for exploring results and defining custom standards.

• Quodeq is a free, local, MIT-licensed AI scanner that grades code A–F across six ISO 25010 dimensions and maps findings to CWE IDs with concrete fix plans.
• It works with either cloud models (Claude, Gemini, Codex) or fully local models via Ollama, so scans can run with no telemetry or accounts.
• Sample output catches real-world issues like SQL injection, hardcoded credentials, missing rate limiting, and bare-except clauses, each with file/line references and code snippets.
• Install via pipx/pip and run from CLI or an Electron dashboard with heatmaps, trend graphs, and support for custom rule sets like Clean Architecture or DDD.

The UK’s AI Safety Institute tested Claude Mythos and found its ability to uncover security flaws scales directly with the number of tokens spent. This creates a simple economic model: defenders must outspend attackers on AI-driven reviews to stay secure. It also boosts the value of open source libraries, since multiple users can share the cost of token-based audits.

• UK AI Safety Institute confirmed vulnerability discovery scales directly with tokens spent using Claude Mythos Preview
• Security becomes a spending race: defenders must outspend attackers on token-driven audits to stay ahead
• Open source libraries gain outsized value since audit costs get shared across all downstream users
• Falling token costs and improving AI efficiency make shared/communal security audits progressively cheaper