• IBM i PTF Guide, Volume 28, Number 38

  November 2, 2026 Doug Bidwell

  Welcome to this week, where the IBM i platform has two issues you need to be aware of as well as a security bulletin. Yup, we said “a” there, meaning only one, meaning it looks like people were out trick or treating instead of bug hunting. Which is fine.

  The first issue is related to Access Client Services. IBM has put out a note that warns: “Versions 1.1.9.1 through 1.1.9.16 are vulnerable to memory exhaustion via a malicious SFTP server sending unsolicited replies. The SFTP client (Apache MINA SSHD) did not verify that incoming replies corresponded to previously sent requests …

  Read more

• Fresche Launches OpsIQ, a Free AI-Based Operation Assistant for IBM i

  October 26, 2026 Alex Woodie

  IBM i developers have embraced AI-based coding tools, such as IBM’s Bob and Anthropic’s Claude Code, but IBM i administrators so far haven’t benefited from the AI productivity boost in the same way. That is starting to change, and one of the first AI-based administrative helpers is a free tool launched recently by Fresche called OpsIQ.

  OpsIQ is an AI assistant designed to help IBM i users get answers to questions about their systems. It is currently a read-only tool for helping users interrogate the system for information about server configurations, the state of jobs, and errors or alerts, which …

  Read more

• IBM i PTF Guide, Volume 27, Number 33

  August 25, 2025 Doug Bidwell

  It might be a good and convenient thing that the WebSphere Application Server, the Web server embedded in the IBM i platform two and a half decades ago and making it part of the Internet, is based on the open source Apache Web server. But it sure does have a lot of patches. The good news is that because it is open source, it is patched regularly and problems do not fester in obscurity.

  In this week’s IBM i PTF Guide, there are a slew of security vulnerabilities related to WebSphere, as there sometimes is. Let’s walk through them all. …

  Read more

• Guru: A Faster Way To Sign A JWT

  July 21, 2025 Chris Ringer

  In my prior article, which you can read here, I discussed using the OpenSSL tool to asymmetrically sign a JWT. I like OpenSSL because it’s an open source solution available on many platforms and easy to use. But the decision to use OpenSSL should be coupled with the performance level expectations (the PLA) for your project.

  For instance, how many tokens will you need to create in a given interval? Will your newly minted tokens expire 24 hours from now or in 5 minutes? In my case currently, only about 5 JWTs are needed per day so …

  Read more

• Summer of IBM i Vulnerabilities

  September 18, 2024 Alex Woodie

  IBM has patched more than two dozen software vulnerabilities in the IBM i stack over the past few months, including flaws in Merlin, MQ, OpenSSH, the Java stack, Db2, Performance Tools, and the HTTP Server (the one powered by Apache). Nine of the security vulnerabilities carry CVSS Base scores of 7 or higher, while one is above 8, making these serious security threats. If you haven’t applied the patches yet, you’re encouraged to do it soon.

  Working backwards from the most recent security bulletins, we start with September 5, when IBM issued patches for three vulnerabilities in Merlin, which officially …

  Read more

• Guru: Web Concepts For The RPG Developer, Part 3

  July 22, 2024 Chris Ringer

  Greetings everyone. Articles part one and two were both an introduction on how to build components in an HTTP request. In part three, we will begin to connect the dots and discuss how to asymmetrically sign a simple string. If you ever need to send a secure HTTP request to a government agency or financial institution, you likely will authenticate with a signed token. So, here we go!

  Base64 Take Two

  In part one, the SQL scalar function BASE64_ENCODE embedded in RPG converted a string to base64. This technique will cover most use cases, but what if you need …

  Read more

• IBM Patches New Security Vulns In IBM i Components, Power Firmware

  February 12, 2024 Alex Woodie

  IBM has patched a series of moderate security vulnerabilities in IBM i products and Power firmware over the past two weeks. The IBM i flaws span Rational Developer for i (RDi), Access Client Solutions (ACS), and the Java development kit and runtime, while the Power flaw involves PowerVM and its communications with the Hardware Management Console (HMC).

  Concerns over security hit an all-time high in the IBM i community according to the IBM i Marketplace 2024 study conducted by Fortra. The survey found that 79 percent of IBM i professionals considered security a top concern, a 10 percent increase …

  Read more

• Old PHP and Other PASE Apps Break on IBM i 7.5

  November 15, 2023 Alex Woodie

  Customers running old versions of PHP and other PASE applications like Node.JS may run into compatibility issues when running on IBM i 7.5. The issue is due to an upgrade in OpenSSL support in the latest release of the IBM i operating system, according to Alan Seiden.

  Seiden, the principle of Seiden Group, first sounded the alarm in July about the problems running older, non-RPM versions of PHP and Node.JS on IBM i 7.5, which was upgraded from OpenSSL version 1.0.2 to version 1.1. In October, he recently published a blog post restating the issue.

  “While [the OpenSSL upgrade …

  Read more

• Spooky New Security Vulns Lurking on IBM i

  November 1, 2023 Alex Woodie

  Halloween has come and gone, but the scares will stick around for a while for IBM i administrators, who have been given more than a dozen fixes by IBM to address some pretty serious security vulnerabilities recently revealed in the heart of the operating system, including in spooky old friends Java and OpenSSL.

  On October 27, IBM issued a security bulletin for two CVEs, including CVE-2023-40685 and CVE-2023-40686, which describe two separate but related security flaws in the Management Central component of IBM i Navigator in IBM i versions 7.2 through 7.5.

  The first privilege escalation vulnerability, CVE-2023-40685, could …

  Read more

• IBM i PTF Guide, Volume 25, Number 37

  September 18, 2023 Doug Bidwell

  There are a few things you can count on in life. Death. Taxes. Coffee. Beer. The love of a good woman. And a seemingly endless barrage of security vulnerabilities for every computing platform on Earth. There are a bunch of the latter that are new to the IBM i platform this week.

  First, we have Security Bulletin: OpenSSL and OpenSSH for IBM i are vulnerable to arbitrary code execution, denial of service, and security restrictions bypass due to multiple vulnerabilities, which you can find out more about at this link. The IBM i PTF number for 5733-SC1 contains the …

  Read more

Previous Articles