What’s New in IBM-i Land? October 2026

October 2026 in Review: The Month the PTFs Arrived Before the Paperwork

Right, kettle on, and possibly the big teapot. October was a busy month for security, and it had a pattern. Again and again, a “Security, all users” PTF turned up in the PSP files first, and the bulletin explaining it arrived days or weeks later. Sometimes it turned out to be a minor fix. Once it was a 9.9. Between those we had PHP2Shell being exploited in the wild, the 268C virtual Ethernet saga, the fall Technology Refreshes, and a lot of BOB and MCP. This post is the whole month in one place, with the final picture for each story rather than the day-by-day “no bulletin yet” updates. Biscuits at the ready.

Security: The Month in One Table

Here’s every IBM i-relevant fix from October’s briefings, roughly in order of how much it should worry you. “No bulletin” means IBM still hadn’t explained the PTF by 30 October.

The Big Three: Db2 Mirror, HTTP Admin and Liberty

The 9.9 in Db2 Mirror (bulletin) is the best example of this month’s pattern. It appeared on the PSP on 30 September as APAR DT502413 with no explanation, and spent nearly a fortnight on my “no bulletin yet” list. It turned out the bulletin had been published on 30 September, and I simply hadn’t found it. Duh! Lesson learned: the PSP and the bulletin pages don’t link to each other, so check both. The same happened with DT502380 (Host Servers) and DT503002, which turned out to be the Liberty fixes (bulletin).

The HTTP Server Admin GUI got hit twice. First came an 8.3 cross-site scripting flaw on 8 October (CVE-2026-93886). Then a 9.9 code injection followed on 12 October (CVE-2026-96119), which needs only low privileges and no user interaction. Both are fixed by the same PTFs.

My take: If the admin GUI (port 2001/2010) or Db2 Mirror’s GUI is reachable from the general network, fix that as well as applying the PTFs. A management interface on the open LAN is an incident waiting for a date.

QSECOFR in a Box, and the 13 October Avalanche

The 13 October PSP refresh dumped nine Security APARs on us with no bulletins. Over the following week every one of them got a name. The headline was CVE-2026-102917 (bulletin), which lets an authenticated user “perform operations with QSECOFR/Root authority”. The rest were the Navigator pre-login flaw, zlib, DCM, OpenSSH chroot, distributed transactions, and the fourth DST/SST CVE in a fortnight (CVE-2026-17488).

My take: “Local” on IBM i means anyone with a sign-on, and that’s a lot of people. Run DSPPTF and confirm SJ11832/SJ11775/SJ11833/SJ11841 are really on. With four DST/SST CVEs, it’s also a good time to audit service tools IDs. Please, no default passwords on QSECOFR or 22222222.

Open Source Corner: PHP2Shell, OpenSSL, OpenSSH and eMudhra

PHP2Shell was the month’s genuine emergency. Unauthenticated remote code execution, every PHP from 5.4 to 8.5, IBM i included, and exploitation in the wild after details leaked before the embargo lifted (IT Jungle, CISA). There’s no IBM PTF. Seiden PHP+ (yum update "php-*", with back-ports to 7.4, 8.0 and 8.1) and Zend both shipped fixes. PHP 7.2 or older needs an upgrade.

5733-SC1 had two OpenSSL bulletins (29 Sep, 23 Oct) and two OpenSSH ones. The mystery DT503775 from 8 October became the sftp path traversal.

Then there’s eMudhra. Its intermediate CA keys were weak enough to forge certificates (Mozilla). There’s no IBM i bulletin and no PTF. Seiden’s mitigation is yum update ca-certificates-mozilla, then update-ca-certificates -f -v. Run their curl test afterwards, update any app with its own CA bundle, and check DCM’s *SYSTEM store for a hand-added Comodo AAA Services or emSign ECC Root CA – G3 root.

My take: “We don’t use open source” is rarely true on a modern IBM i. PASE is doing more of your outbound HTTPS than you think. One PASE session can handle PHP, OpenSSL and the CA bundle together.

The Ones With a Catch

• ACS 1.1.9.17: the mystery DT504777 from 21 October turned out to be ACS (bulletin) two days later. The PTF only puts the new ACS on the server. Every PC still on 1.1.9.16 or older stays exposed.
• Host-Based Printer, CVE-2026-77153: DT501337 showed up on 26 October and got its bulletin on 27 October. Telnet print sessions must now authenticate, so ACS 1.1.9.15 or later is needed or telnet printing stops connecting. Display sessions aren’t affected.
• NFS: IBM warns that without the extra cover-letter steps, “existing NFS mounts [will] become inaccessible” (bulletin).
• IBM i MCP Server v0.6.2 (release notes) has no CVE, but it fixes a read-only mode bypass. A SELECT calling QSYS2.QCMDEXC could run CL commands, DLTLIB included.

My take: Upgrade ACS on the desktops before the printer PTF goes on, or the warehouse labels stop printing on a Monday morning.

Beyond the Partition: BMC, VIOS and Firmware

The two BMC denial-of-service bulletins (CVE-2026-17427, CVE-2026-16682) are fixed in firmware, with OP940.83 for the 7063-CR2 HMC. VIOS 4.1 got around two dozen PostgreSQL CVEs, many at 8.8, fixed in postgres_fix2.tar. Take a verified mksysb first.

My take: The BMC belongs on a private network. If it shares a flat network with the office printers, fix that first.

Technology Refreshes: 7.6 TR3 and 7.5 TR9, GA 20 November

We spent most of October waiting for these, and IT Jungle expected them at NAViGATE. The story only came together on 28 October, though: the announcements were dated 23 October, with availability on 20 November 2026 (7.6 TR3 enhancements).

For admins:

• SYSTOOLS.CVE_CURRENCY shows which PTF fixes which CVE and whether it’s applied. CVE_PTFS covers offline partitions, and Navigator gets a CVE Currency table.
• PW-V audit entries for successful sign-ons, plus a new AUTHMTH parameter on CHGPRF for TOTP.
• QycdRenewCertificate can renew with a fresh key pair and keep the same label.
• Fast-Fail Multi-path I/O (7.6 only), VIOS 4.1.3.0, and USB flash drives up to 1 TB.
• In Navigator, the save/restore master key no longer has a default.

For programmers (RPGPGM):

• %INFO returns the program, module, statement number, job and more. It needs a runtime PTF on every target system.
• *INZ(LIST) and DIM(*INZ).
• *ALWUPD(NO) blocks UPDPGM.
• Db2 group SF99960 level 4 brings SELF exclusion lists and QSYS2 HTTP logging and decompression.

My take: CVE_CURRENCY would have saved me half of this month’s PSP-squinting. Follow Javier Herrera Cuellar’s advice and don’t install on day one. Wait for the final PTFs and the first HIPER group, and test printing.

Db2, RPG and Developer Tooling

• Db2 7.6 data change table references now work on UPDATE and DELETE. OLD TABLE gives you the before-image, and FINAL TABLE fails the statement rather than return stale rows (Nirmal Khatri). It’s not a replacement for journaling.
• GENERATE_SPREADSHEET gained SHEET_NAME in 7.6 TR2 / 7.5 TR8 (RPGPGM).
• RPG as stored procedures without a rewrite (MC Press). Set READS SQL DATA where you can.
• No SDA on 7.6? Try the free Display File DDS Edit extension for VS Code and BOB.
• QSYS2.SYSLIMITS_BASIC gives early warning before you hit 32,767 members. *PPGENOPT(RMVCOMMENT) gets you past RNF0722.
• Mapepire 2.5.0/2.5.1 (23 Oct) adds a read-only server mode, a “basic queries only” mode with IP rules, and a JDBC statement leak fix.
• Code for IBM i held at 3.0.13. Its TR-era update includes a debug service identity fix.
• MCP servers: IBM’s is at 0.6.2. Roni Ström’s read-only Db2 for i MCP Server reached v3.6.1.

My take: Read-only modes are everywhere this month, and that’s welcome. But Ström has it right: “‘the model promised not to’ isn’t a control”. Object authority is.

AI and BOB

• BOB Premium Package for i gained Understand (BOB blog). It does a one-time scan into a Db2 schema, maps callers and callees, and buckets programs by modernisation effort.
• A real-world test (Guru) called it “approaching knock-your-socks-off impressive”. But $100 for 160 Bobcoin lasted about 10 working days, and consistency was hit and miss.
• BOB DevSecOps Premium Package (announcement) costs USD 20 per user and is SaaS only. It includes SafeWrite dependency guarding and SAST scanning. (A Nick Warning: IBM doesn’t say whether it covers RPG or CL, so check before claiming it does.)
• Give BOB a sandbox with isolated data and limited authority (Jeffrey Williams).
• Jeff Cubinski’s MCP explainer (tools, resources, prompts) uses stored procedures as tools, so the AI never writes its own SQL.
• Power Autonomous Operations went GA and exposes 40+ functions via two MCP servers (heise). It doesn’t read IBM i directly yet.
• Fresche OpsIQ (free, read-only) uses Anthropic’s Claude in the cloud. Infor Velocity reaches LX, XA and System21 via Multi-Tenant Infor OS.

My take: The theme is clear. MCP is becoming the plumbing, and the sensible people keep saying the same thing: read-only first, narrow profiles, no *ALLOBJ, and check what goes to the cloud. Keep an eye on the Bobcoin meter, too.

Vendor, Business and Community News

• IBM Q3: Distributed Infrastructure up 31% (32% at constant currency), with Power named as a growth driver (results). IBM doesn’t break out Power.
• IBM financing: an interest-free “Buy Now, Pay Later” offer runs until 31 December, US and Canada only (IT Jungle). It’s unclear whether the $5 million threshold is a minimum or a maximum.
• IBM i Solution Edition now offers the Power S1112 (details), with up to 4 cores and 64GB for IBM i and BRMS bundled.
• Fortra Continuity Care with FalconStor offers immutable backups and quarterly clean-room recovery tests (TechChannel).
• TD/OMS V19 M1 removes CRTZIPF in favour of CPYTOARCF (Remain).
• SAVF checksums can be recomputed (Silent Signal). They catch corruption, not tampering, so rely on object signing and QVFYOBJRST.
• GoDaddy R1 certificate chains can trip up DCM (thread).
• Authority Collection walkthrough (MC Press), and a succession planning case study (vendor-written).
• Surveys: the Fortra Marketplace Survey and the State of AI survey. TechXchange/NAViGATE ran in Atlanta from 26 to 29 October.

My take: Lots of vendor news, and the common thread is recovery and skills. A backup you’ve never restored is a hope, not a plan. The same goes for an RPG expert you’ve never shadowed.

Known HIPERs, Defective PTFs, and What’s Still Pending

• 268C virtual Ethernet, two rounds. First, 7.6 TR2 / 7.5 TR8 could cause complete loss of connectivity, fixed by HIPER LIC PTFs MJ11726 (7.6) and MJ11725 (7.5) (advisory). Then on 13 October, SJ09224/SJ09225 were marked defective, with the fix in SJ11741/SJ11742. IBM’s advisory still hadn’t caught up.
• Defective LIC PTFs: MJ10605 on 7.6 stops queries, fixed by MJ11309. MJ09778/MJ09796 cause MINENTDTA journal deadlocks on 7.5 and 7.4, fixed by MJ11495/MJ11494. These were still “when available” all month.
• Gotchas: HTTP CGI MCH3601 on SF99962 levels 9–10 and SF99952 levels 28–29. QFileSvr.400 breaks after SJ11188–SJ11191. NetServer stops working with NTLMv1. NTP fails after SJ11498 on 7.5. DDM/DRDA needs both ends patched.
• Unexplained: DT501848 (SJ11561–SJ11564), the HTTP Server PTFs (SJ11588 and friends), and DT503167 “Code Inprovement” (MJ11724/MJ11723/MJ11722, IBM’s spelling).
• Dates: TR3/TR9 and the Db2 groups (SF99960 level 4, SF99950 level 13) land on 20 November. The next cume is 4 December. PTFs in Error was last updated 13 October.

My take: Book a pre-Christmas window covering 20 November to 4 December now, before the change freeze books it for you.

Bottom Line

1. Apply the 9.9s and 9.8 first: Db2 Mirror (SJ11623–SJ11625), the HTTP Admin GUI (SJ11641–SJ11645) and Liberty (SJ11689–SJ11692).
2. Patch PHP now if it runs anywhere on IBM i. Upgrade anything on 7.2 or older.
3. Close the QSECOFR escalation (SJ11832/SJ11775/SJ11833/SJ11841) and check it with DSPPTF.
4. Plan an IPL for the DST/SST LIC PTFs, and audit service tools IDs.
5. Get ACS 1.1.9.17 onto every PC, then apply the printer PTFs (SJ11502 and friends).
6. Read the NFS cover letters before applying anything.
7. Fix PASE: OpenSSL, OpenSSH, zlib and ca-certificates-mozilla.
8. Check for 268C adapters and the defective MJ PTFs.
9. Order the unexplained PTFs anyway, and check the PSP and the bulletin pages.
10. Firewall your BMC, HMC GUI and Navigator.
11. Diary: 20 November (TRs and Db2 groups) and 4 December (cume). Don’t install the TR on day one.

Until next time, keep those IBM i systems humming.