Welcome to another edition of Talsco Weekly

In This Issue

IBM i Briefs: 🧱 IBM's whole AI pitch fit on one slide. 📦 The fall TRs landed right on schedule.
AI: 🔦 A free AI assistant for the 2 a.m. IBM i alert. 🐝 Bob now checks the code AI writes before it lands.
Career: 🧳 You're back from TechXchange. Now what?
Development: 🕒 How long was that user really signed on?
Database: 📊 Your first quick win is one SQL statement.
Leadership: 🏪 The best IBM i tool might not have had a booth.
Learning: 🔀 3,000 IBM i projects are waiting on GitHub. 🧪 Stop studying AI. Build something with it.
Modernization: 🗺️ IBM says the mainframe needs modernizing. With AI.
Open Source: 🔌 The open-source way to let AI talk to IBM i.
Security: 🔒 PHP2Shell went from patch to attack in days.
Did You Know: 🗓️ IBM i's Technology Refreshes turned 16 this fall.

IBM i Briefs

🧱 IBM's whole AI pitch fit on one slide

IBM

And existing systems sit at the foundation.

TechXchange wrapped Thursday in Atlanta, and one main-stage slide summed up IBM's message.

Agents sit on top. They reason, decide, and act.

Under them sits data: real-time, structured, and unstructured. Then the tools to build and connect, and the controls to secure and run it all.

The foundation is "Anywhere": open, hybrid, and existing systems.

The week's announcements followed the same order. A tool to give agents context on the systems you already run. Verified identities for every agent. And a kill switch, in tech preview, for the ones that misbehave.

The IBM i Angle: Look where "existing systems" landed. Not on a migration slide. At the foundation, underneath the agents.

That covers platforms like IBM i. IBM's message is that you don't rebuild for AI. You give agents context on what you already run, and rules for what they can touch.

Which puts the people who know those systems at the center of every AI plan.

📦 The fall TRs landed right on schedule

IBM i 7.6 TR3 and 7.5 TR9 arrive Nov. 20.

Last week we said the fall Technology Refreshes would show up at TechXchange. They did.

IBM announced IBM i 7.6 TR3 and 7.5 TR9 at the conference on Tuesday, with availability planned for November 20.

Early highlights from RPGPGM's Simon Hutchinson:

RPG arrays you can initialize with a list of values.
A new %INFO built-in function that returns what's in the RPG status data structure.
A compile option that blocks changes to a program through UPDPGM.
SQL updates, including new options on the QSYS2 HTTP functions.

Expect community deep dives over the next few weeks.

AI

🔦 A free AI assistant for the 2 a.m. IBM i alert

Plain-English answers about your IBM i system.

IBM i developers got AI coding tools first. Administrators are next.

OpsIQ, a new free tool, lets operators ask plain-language questions like "Why did this job end abnormally?" It writes the SQL, runs it on IBM i, and explains the answer.

It's read-only for now. It diagnoses and recommends. A person still takes the action.

In one demo, it traced a stalled nightly batch to a file that wasn't where it belonged. In another, it found 13 enabled profiles at QSECOFR level that had never signed on.

Reality Check: "Free" comes with an asterisk. Out of the box, OpsIQ runs on Anthropic's Claude in the cloud, which means an open port and system details leaving the building. The included Claude trial runs 45 days.

That's not a reason to skip it. It's a reason to ask first.

Because if IT doesn't bring tools like this in the front door, users will bring their own. One survey this year found two-thirds of office professionals had used AI tools they believed weren't allowed.

Do you know which AI tools your people are already using? That's shadow AI, the new shadow IT.

🐝 Bob now checks the code AI writes before it lands

A security layer for AI-written code.

AI agents write code fast. Security reviews usually show up after the risky change is already in.

IBM's new Bob Premium Package for DevSecOps, announced Oct. 27, moves that check up front.

Its SafeWrite feature catches AI-proposed dependency changes before they hit disk. It swaps a known-vulnerable version for the nearest fixed one, or blocks the install when no fix exists.

Built-in scanning flags vulnerable code, exposed secrets, and risky dependencies as files are opened and saved. Pull request reviews arrive in November, starting with GitHub.

Developers keep the final say on every merge.

The IBM i Angle: This is built for open-source stacks and Git repos. Don't read it as an RPG scanner.

But plenty of IBM i shops now run PHP, Node.js, and Python on the box. As this issue's Security section shows, that's exactly where the dependency risk lives.

Career

🧳 You're back from TechXchange. Now what?

The notebook is full. The calendar isn't.

TechXchange and NAViGATE wrapped up Thursday in Atlanta.

If you were there, you flew home with a notebook full of ideas. Bob. MCP. Agents. A dozen vendors with a dozen answers.

Here's what happens next at most shops. Monday hits. The backlog wins. The notebook goes in a drawer.

Your company paid for that trip for a reason. The return isn't your notes. It's what ships in the next 30 days.

And you're in a better spot to deliver it than almost anyone. You know how every department actually runs, because you've written the code behind it.

So skip the slide deck about technology. Start with people.

People: Find one leader with a problem. What keeps the CFO, the sales VP, or the plant manager up at night?
Process: Map what they actually do, step by step. You probably know it better than they do.
Technology: Only now, pick from what you learned.

Most pitches die because they lead with the tool. Lead with their problem.

From the Field: The IBM i developers I talk with have the knowledge. What they hold back is the pitch. They know the business cold and still hesitate to walk into an executive's office with an idea.

You don't need approval for a big modernization project. You need one quick win, built on data you already have, with your manager's blessing.

What does a good first AI project on IBM i look like? Start read-only. Reports, summaries, plain-language questions against your own data.

Back from the show with an idea and no runway? Let's talk about your next move. Book a call.

Development

🕒 How long was that user really signed on?

Session time for any IBM i user, in one query.

Who signed on to your IBM i this week, and how long did they stay?

In part two of his IT Jungle Guru series, Mike Larsen answers it with SQL and the QSYS2.HISTORY_LOG_INFO table function.

He pulls the sign-on and sign-off messages, CPF1124 and CPF1164, from the history log for the past five days.

Two common table expressions split them apart. A join matches them by job number. TIMESTAMPDIFF returns each session's length in minutes and in hours.

Add the user ID you want to check, and it's ready to run. For audits, it pairs well with this issue's Security section.

Database

📊 Your first quick win is one SQL statement

Live IBM i data, straight into a named Excel sheet.

Every executive lives in Excel. Most IBM i data gets there the hard way: a query, a download, someone fixing columns by hand.

GENERATE_SPREADSHEET skips all of it. One SQL statement runs your query against Db2 for i and writes an .xlsx file to the IFS.

With IBM i 7.6 TR2 or 7.5 TR8, a new SHEET_NAME parameter means the tab reads "Open Orders" instead of "Sheet1." Small change. It's the difference between a data dump and a report.

RPGPGM's Simon Hutchinson walks through it from Run SQL Scripts and from an RPG program.

Our Take: This is the Career section's quick win, in one line of code.

Pick one manager. Ask what report they rebuild by hand every week. Pair this with a scheduled job and an email step, and it lands in their inbox every Monday, named and clean.

When they ask where it came from, the answer is the system you already have.

Leadership

🏪 The best IBM i tool might not have had a booth

Look past the expo floor.

Your team is back from Atlanta with a bag full of brochures.

Notice whose they are. The biggest booths belong to the vendors who can afford them. Plenty earned that spot, with products that have run IBM i shops for decades.

But the expo floor is pay-to-play. It doesn't show you everything.

Some of the best IBM i tools come from small shops and solo developers. Utilities built to solve one company's problem, proven in production there, and now, with AI shortening the build, coming to market.

Back in May, we covered an independent developer porting Go to IBM i because IBM wouldn't. That's how good tools get started now.

You can see it in this issue. A free study kit from one independent consultant. An open-source MCP server. A free SQL how-to from a community blog. None of them had the biggest booth.

Cut through the pitch: Booth size is not a buying criterion. Fit is.

Small vendors bring a different risk, though. Sometimes the whole company is one developer. That's the same single point of failure you'd never accept on your own team.

So vet continuity before you sign:

Who supports it if the founder steps away?
Is the source in escrow, or on GitHub?
Who else runs it in production, and will they take your call?

Big or small, ask every vendor the same questions. Then pick the one that solves your problem.

Weighing a new tool, or the people to run it? Let's talk. Book a call.

Learning

🔀 3,000 IBM i projects are waiting on GitHub

Git, decoded for RPG developers.

AI coding tools live in Git. Bob, Claude Code, and Copilot all work inside repositories, propose changes, and wait for review there.

Search GitHub for "IBM i" and you'll find about 3,000 repositories.

Start with five words:

Repository: a project's files plus the full history of every change.
Commit: one saved change, with who, when, and a note on why.
Branch: your own working copy. Change anything without touching the main code.
Pull request: a proposed change, shown line by line, reviewed before it merges. This is where AI-written code gets checked.
Issue: the project's to-do list. Bugs, requests, and questions, each with its own thread.

New to Git: Git tracks files, not source members. So source usually moves from source physical files into IFS stream files first, or a bridging tool handles it. Where does your RPG source need to live for Git to see it? Git itself runs right on IBM i, in PASE.

For IBM i veterans: You already know these ideas by other names. A branch is a test library for source. Commit history replaces the change log at the top of every program.

🧪 Stop studying AI. Build something with it.

One developer's IBM i AI setup, free to copy.

The fastest way to learn AI isn't reading about it. It's making it do real work on your own system.

An independent IBM i consultant did exactly that while prepping for a certification. Instead of only reviewing docs, he built a working setup and published it free on GitHub.

It's written for IBM Bob, but the pieces carry over to Claude Code, Codex, and other AI coding tools: a project briefing file, rules for your standards, reusable skills, and read-only SQL tools.

And the examples are pure IBM i. RPG, CL, fixed-to-free conversion, RPGUnit tests.

New to AI on IBM i: Don't try to absorb the whole thing. Pick one piece, a rule or a skill, and make it work on your own code. That's the lesson.

For IBM i veterans:What would your shop's rules file say? Your standards and "never do this" lessons are what any AI tool needs most. Write them down.

Modernization

🗺️ IBM says the mainframe needs modernizing. With AI.

A mainframe story with an IBM i lesson.

IBM rarely says its flagship platform needs help. This week, it did, for the mainframe.

In a Statement of Direction, IBM described IBM Z Atlas, a planned AI tool that maps an entire z/OS stack: infrastructure, middleware, and applications.

The goal is safe change. IBM says unproven changes are the leading cause of unplanned z/OS outages, so Atlas would show what a change touches, test it, and validate it first.

People stay in charge. AI recommends. Humans decide.

Notice what modernization means here: staying on the platform and making it easier to live with.

Déjà vu: Different platform, same conclusion we reached last week on IBM i. AI tools that map programs, files, and dependencies make old code safer to change.

And it holds whether you stay or go. Moving to NetSuite, SAP, or Epicor? You still have to know what connects to what, clean the data, and map the business process first.

That's no-regret work either way. And the people who know the map are usually the ones closest to retirement.

Open Source

🔌 The open-source way to let AI talk to IBM i

IBM's MCP server for IBM i is free.

Model Context Protocol, or MCP, is how AI assistants like Claude, Copilot, and Bob connect to outside systems. It had its own session at NAViGATE this week.

IBM's version for IBM i is open source on GitHub under the Apache 2.0 license.

So what is it, actually? A server that lets AI agents query Db2 for i through SQL tools you define in simple YAML files. Ready-made sets cover performance, security and audit, jobs, storage, and database.

A command-line version gives developers the same tools without a server. Both need Mapepire running on IBM i.

The Bottom Line: This is the governed answer to shadow AI.

Build it on your own YAML tools, and the agent works from the queries you wrote. You decide the menu.

That's how IT says yes to AI without handing over the keys. What would your first read-only tool be?

Security

🔒 PHP2Shell went from patch to attack in days

Now it's confirmed. Attackers are using it.

Last week, PHP2Shell was a warning. This week, it's an active attack.

CISA added both flaws to its Known Exploited Vulnerabilities catalog on Monday and gave federal agencies until Thursday, Oct. 29, to patch.

Amazon says attackers began probing on Oct. 17, four days before patches shipped. A leak forced the PHP team to release early.

The flaws hit every PHP version from 5.4 to 8.5, on every platform, IBM i included. Several European governments took websites offline as a precaution.

IBM i PHP providers have shipped fixes, including backports for some end-of-life versions.

Last week, we said patch it: Now the question is whether you did.

And if PHP was the open door, what's behind it? Plenty of IBM i shops are secure by design and loose in practice. Powerful profiles nobody uses. Old service accounts. Authority nobody has reviewed in years.

IBM i ships with strong security. It only works if you use it.

How many powerful profiles on your system have never signed on? One SQL query will tell you.

Did You Know

🗓️ IBM i's Technology Refreshes turned 16 this fall

Before 2010, new features waited for a new release.

This week's fall TRs are part of a habit that started with IBM i 7.1.

The first Technology Refresh shipped on September 10, 2010. It replaced the old point and modification releases with something simpler: new function, tested and delivered together as a PTF group, no full upgrade required.

IBM i 7.1 alone got 11 of them.

Some of the tools in this issue arrived the same way. The HISTORY_LOG_INFO function behind the Development tip came in 7.3 TR1 and 7.2 TR5. GENERATE_SPREADSHEET's new sheet names came in 7.6 TR2 and 7.5 TR8.

Do you know of someone who could benefit from Talsco Weekly? If so, please use the social media buttons to spread the word. Thank you!

RPG developers: you're back from TechXchange. Now what?