In this episode of the IBM i Update, I’ll be:
- Explaining how API’s are the path forward in integration
- Answering the question ‘What are IBM’s Power Autonomous Operations?‘
- Asking whether VS Code for i is becoming the default IBM i development environment
- Explaining when and where the i-UG Midlands Conference 2026 is
- Providing details on what IBM i users should do with regard to the October 2026 critical PHP security vulnerability
Are API’s are the path forward in integration?
APIs are all the vogue these days but for the IBM i shop, there’s debate on how best to develop and use these and unlock more value from your existing IBM i applications.
So, let’s first ask the question, ‘what do Application Programming Interfaces (or APIs to you and I) actually do?’
Well, an order arrives through your website… A customer wants a delivery update… Your warehouse needs to check stock…
With each of these questions, and more, your IBM i application may already hold the answers.
But is it easy and economical to find the answers to those questions, and then allow those answers to reach the systems and people that need them, well, that’s the issue we’re looking to address here.
If information moves through spreadsheets, manual rekeying or overnight updates, well, that creates friction. Staff spend time transferring data, customers wait for responses and projects become harder to deliver.
Integration offers a way to make more of the applications you already depend on, connecting their information and business processes with websites, customer portals, cloud services and trading partners.
And APIs are perhaps the most efficient and secure way to make that happen.
An API provides a defined way for one application to request information or ask another application to perform an action.
That might mean checking stock, submitting an order or retrieving a customer’s agreed price.
IBM i already supports this. Suitable existing programs can be exposed as web services, and IBM i applications can also call services on other platforms.
The important part is preserving the business rules behind those transactions.
Your application may contain decades of knowledge about pricing, credit limits and stock allocation. A good integration uses those rules consistently.
Some applications will need preparation before that logic can be reused. And so, understanding how the application works is therefore just as important as building the connection.
For many businesses running IBM i, EDI already handles essential exchanges with customers and suppliers.
Purchase orders, invoices and shipping notices move through established processes. Where those arrangements work well, there may be no reason to replace them.
APIs can add capabilities alongside them. Or even replace them.
A customer might place an order through EDI, then use a portal connected through an API to check its progress.
The choice depends on what the business needs, how quickly information must move and what trading partners support.
Middleware or an integration platform can help coordinate these connections. But it still needs a reliable route into the IBM i application and a clear understanding of its business and validation rules.
Now, at Proximity, we’ve supported many European businesses with their API requirements, so I asked the team where you should start, and the answer was simply that ‘the best starting point is a process that causes the most frustration’.
Need to connect your IBM i with your other systems? Check out our Bespoke IBM i Integrations services page.
Perhaps where staff rekey online orders, customers phone for delivery updates or information is maintained in two systems.
Map that process. Identify where the information lives, which rules matter and what a better outcome would look like.
Build in security, monitoring and recovery from the start. Decide who takes responsibility when something fails.
Then measure the difference, whether that means fewer errors, less manual work or faster customer responses.
But the overriding question should be: where is information getting stuck in your business today?
And that’s really the point of putting the ‘i’ into IBM i.
For many organisations, the intelligence, the information and the business processes are already there, built up over decades of development.
The opportunity isn’t necessarily to replace those applications, but to make them more accessible, more connected and ultimately more valuable to the business.
APIs can provide the means to do that, but the technology is only part of the answer. Understanding your applications, preserving their business rules and choosing the right integration approach are equally important.
What are IBM’s Power Autonomous Operations?
Now, IBM’s autonomous Power strategy starts to become real, as towards the end of September, IBM Launched their New AI Agent that identifies and resolves capacity constraints, autonomously.
IBM’s Power Autonomous Operations are now generally available.
It introduces an AI agent for Power environments that continuously monitors systems, identifies operational issues such as capacity constraints and can take action to resolve them.
IBM says capacity constraint issues can be resolved up to 15× faster than manual intervention, and administrators can also interact with the environment through natural, conversational prompts.
The bigger story for IBM i is IBM’s direction of travel.
Bob handles the application-development side, while Autonomous Operations starts applying agentic AI to the running and management of the underlying Power environment.
So what IBM are doing is positioning AI as part of the power platform itself, rather than something customers simply run on it – a good strategy.
Is VS Code for i becoming the default IBM i development environment?
This time last year, the install base for VS Code for i was just over 50,000. Nearly a year on and we’re up nearly 100%… which begs the question: is VS Code for i becoming the default IBM i development environment?
Yes, Code for i is now approaching 93,000 installs; we could topple the 100k mark by the end of the year.
And it’s not difficult to see why people are using it.
Continual development and expansion with the latest IBM i filesystem extension now reaching production status and supporting 22 IBM i object types.
In addition, Code for i now supports Mapepire and IBM i 7.6 MFA, while work is under way on an IBM i Renderer intended to let developers open and edit DDS display files from VS Code, effectively providing a modern development experience for IBM i in which you can build, edit, test and manage IBM i applications.
When is the i-UG Midlands Conference?
A final reminder to register and join i-UG for their Midlands conference at the beginning of November…
That’s right, the i-UG Midlands conference takes place on Tuesday the third of November at The Mount Hotel in Wolverhampton, and there’s plenty on the agenda.
Sessions cover IBM Bob and AI, Power11 and Spyre, alongside a look inside the new IBM i application modernisation Redbook.
Security also features strongly, with talks on governed AI, securing SSH and cyber recovery.
And it’s not all technology-focused, as we’ve sessions on retaining knowledge when colleagues leave, developing leadership skills and improving communication.
Add in the keynotes, cloud and Linux sessions, plus time to catch up with the IBM i community, and it promises to be a worthwhile day. Register now
PHP critical security flaw October 2026 – How to secure your IBM i
Finally, towards the end of October an announcement was made on two critical security vulnerabilities identified in PHP, the technology behind many business websites, portals and APIs.
Now, under certain conditions, these flaws could allow an attacker to run malicious code on a vulnerable web server without logging in.
So, I spoke with a PHP development leads here at Proximity and asked if this is just a problem for websites or if this would affect IBM i organisations too, and if so, what to do about it.
First, for IBM i organisations, the key message is that running PHP on IBM i doesn’t remove the need to address these vulnerabilities. The issue sits within PHP itself.
Where PHP applications connect to Db2 data or call business programs, a compromised application environment could put those resources at risk, depending on the permissions and credentials available to it.
So, what should you do?
Well, first you should urgently identify where PHP is running, which versions you use and who is responsible for maintaining it, prioritising applications accessible from the internet.
The priority is to update the PHP runtime using the security fixes supplied for your installation.
Speak to your PHP provider or application support partner, confirm the correct package, and apply it promptly. After updating, restart the affected services and verify that your web applications are actually running the patched version.
Include checks of database connections, business program calls and critical application functions.
For older PHP installations, confirm whether your provider offers a backported fix or whether an upgrade is required.
If you cannot patch immediately, restrict or isolate exposed services while agreeing a remediation plan. Temporary configuration changes are not a complete fix.
Finally, review exposed systems for evidence of compromise.
Patching closes the vulnerability, but does not remove anything an attacker may already have installed.
Need support for your IBM i? Check out our IBM i Support & Maintenance services.
And that’s it for episode 40 of the IBM i Update.
I’m Andrew Nicholson, and we’re Proximity, your application support, maintenance and development partners who are in your corner.
If you missed it, you can check out my previous update here, or access all the IBM i Updates in one place.
Alternatively, if you’d like to receive the latest IBM i Update hot off the press to your inbox, subscribe to the IBM i Update on LinkedIn.
