BOB Moves Indoors, PTFs Pile Up, and IBM Wants a Bit More Money in 2027
Another fortnight, another pot of tea, another pile of IBM i news. This roundup covers 20 September to 4 October 2026. I’ve made three piles: AI coding tools moving inside the firewall, the usual steady run of security patches, and a 2027 IBM price increase that you really want to know about before someone asks you for next year’s budget. 😉
Grab a mug. Here we go.
IBM BOB Comes In From the Cold (Self-Hosted and Air-Gapped)
Yes, I know. I promised to stop writing about BOB. I lied.
On 30 September 2026 IBM announced that IBM Bob can now be self-hosted on Red Hat OpenShift. That includes fully air-gapped environments. The bit that matters for us: the IBM i Premium Package (the RPG/CL workflows and the IBM i knowledge) works there too. The BOB team wrote it up on the BOB blog on 1 October.
My take: I think this is the biggest story in the fortnight for IBM i shops. Every time I show BOB to a client, the first question isn’t “can it convert fixed-format RPG?” It’s “where does our source code go?” Banks, insurers, government, anyone with a nervous auditor – they’ve been stuck watching from the sidelines. Being able to run it inside your own walls, with no line to the outside world, takes away the best excuse for not even trying it. I’d expect the conversation to change from “we can’t” to “who’s going to look after the OpenShift cluster?” Which is a much better problem to have.
CVE-2026-84414: Go and Apply These PTFs. Now. Please.
Right, this is the one where I put my serious face on.
IBM published a security bulletin for CVE-2026-84414 on 24 September. It’s a flaw in Network Authentication Service that lets a low-privilege local user change ownership of any file, which can lead to a full system takeover.
- CVSS: 7.8 (High)
- Affected: IBM i 7.3, 7.4, 7.5 and 7.6
- Workaround: None
- PTFs:
- 7.6: SJ11607
- 7.5: SJ11608
- 7.4: SJ11609
- 7.3: SJ11610
My take: “Low-privilege local user” and “change ownership of any file” are not words that belong in the same sentence. There’s no workaround, so the PTF is the plan. If you’ve read my rant about QSECOFR still having the password QSECOFR, you know I’m not keen on shops treating security PTFs as “something for the next maintenance window, maybe, if nothing else comes up”. Book the downtime. Apply it. Then have a biscuit.
The PTF Guide: Eleven Security Bulletins, Because Of Course
On top of that, the IT Jungle PTF Guide from 21 September lists 11 security bulletins. They include:
- A Db2 Mirror for i spoofing login bypass (CVE-2026-18065)
- 15 Java CVEs
- Fixes for Navigator for i, Digital Certificate Manager and WebSphere
My take: None of this is exciting. All of it is important. It’s the same story I told about ACS 1.1.9.14: boring? Yes. Important? Also yes. 🙂 If you run Db2 Mirror, I’d move the login bypass one to the top of the list. A spoofed login on the box that’s meant to be your safety net is about as funny as a tape drive that only works if you stroke it.
IBM “Global Price Harmonization” – Budget For It Now
IT Jungle reported on 21 September that IBM’s “global price harmonization” increases take effect on 1 January 2027. They cover software, storage and cloud. Power hardware is not going up. IBM has told business partners rather than customers directly, and the advice is to lock in deals before year-end.
My take: “Harmonization” is a beautiful word. It sounds like a barbershop quartet. It means “things cost more”. The bit that bothers me is that the news went to business partners, not customers. If your partner hasn’t phoned you about it yet, phone them. If anything software, storage or cloud is on your 2027 list, ask for a quote before Christmas, not after.
Costco Shoppers Get Real-Time Inventory (Powered by IBM i, Naturally)
A nice “IBM i doing cool modern stuff” story, also from IT Jungle on 28 September. Costco is using OnQ Solutions’ Converge, which reads live IBM i inventory. It’s been rolled out to 610 US stores, so items that are out of stock stop showing up on the displays. OnQ plans to sell it to other IBM i retailers.
My take: I love this one. Every time someone tells me the AS400 (sorry, IBM i 😉) is a dusty back-office relic, I can point at a story like this. The inventory data was always right there. It just needed a sensible way to get it in front of the customer. I think a lot of IBM i retailers are sitting on the same opportunity and haven’t noticed yet.
PHP 8.6 Beta for IBM i from Seiden Group
According to IT Jungle on 28 September, Seiden Group has a PHP 8.6 beta for IBM i. Highlights:
- Clearer error messages. That feature came from a Seiden developer.
- Safer session defaults
- Faster JSON
And the important bit: PHP 8.2 security fixes end with 2026.
My take: It’s lovely to see a feature come from someone in the IBM i world. Clearer error messages are a gift to any developer who has stared at a cryptic stack trace at 2 a.m. If you’re still on PHP 8.2, that end-of-2026 date is closer than it looks. Time to put the upgrade on the list.
Code for i Keeps Growing (Sorry, RDi)
IT Jungle’s Code for i update on 21 September has some cracking numbers:
- About 93,000 installs of the free VS Code extension, up from 53,000 a year ago
- The Fortra 2026 survey says more developers now use it than RDi
- A new extension for browsing and managing IBM i objects inside the editor
- A replacement for the display file designer is in the works
My take: I’ve been saying it for a while and the survey backs me up. The VS Code way of doing IBM i development isn’t the “alternative” anymore. It’s the mainstream. The display file designer is the last big reason I hear people give for keeping RDi on their machine, so I’ll be watching that one closely.
What Didn’t Happen
- No autumn Technology Refresh in this window. 7.6 TR2 and 7.5 TR8 shipped on 24 July.
- The next Db2 for i group PTF is planned for 20 November 2026. Pop it in the diary.
Bottom Line
If you only do three things this week:
- Apply the CVE-2026-84414 PTFs. No workaround means no excuses.
- Work through the PTF Guide security bulletins, starting with the Db2 Mirror one if it applies to you.
- Talk to your business partner about 2027 pricing before the year runs out.
Then, once the boring stuff is done, have a look at self-hosted BOB and the latest Code for i. That’s the fun part.
Got thoughts on any of these? Drop a comment on the blog or the YouTube channel. I read them all (usually with a cup of tea in hand).
Until next time, keep those IBM i systems humming. And apply those PTFs.
