Alan Seiden

PHP 8.6 is Coming Soon to IBM i

/1 Comment/in /by

Scheduled for late 2026, PHP 8.6 is expected to bring numerous improvements, especially in diagnostics, security, and performance.

Here are several PHP 8.6 highlights that I see as helpful for IBM i users and a note about PHP 8.2 going end-of-life.

Seiden Group’s Contribution to PHP 8.6

We are especially pleased that one of the proposed PHP 8.6 enhancements comes from our own team. Calvin Buckley of Seiden Group wrote the RFC to display function arguments in PHP error messages:

https://wiki.php.net/rfc/display_error_function_args

This improvement is designed to make debugging easier by showing more information when a built-in function fails.

For example, instead of seeing only that a file operation failed, developers may be able to see which argument caused the problem. That kind of detail can save time when troubleshooting production issues.

Easier JSON Troubleshooting

PHP 8.6 should help when looking for invalid JSON. Before PHP 8.6, json_last_error_msg() would describe the error, but not tell where in the JSON string to find the invalid portion.  Now, in 8.6, if json_decode() fails, error and exception messages can indicate where the JSON problem occurred. Courtesy of the php.watch site, here is an example:

For applications that exchange data with APIs, web services, JavaScript front ends, and vendor systems, this should make testing and support easier.

Safer Defaults and Security Hardening

PHP 8.6 also includes security improvements. More secure session defaults are planned, including strict session mode, HttpOnly session cookies, and SameSite=Lax cookies:

https://wiki.php.net/rfc/session_security_defaults

These settings help reduce common risks such as session fixation, stolen cookies through JavaScript, and some cross-site request forgery scenarios.

Other security-related changes include tighter handling of invalid inputs, safer SQL string quoting for mysqli, and limits on long php://filter chains that have been abused in certain attack techniques:

https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy

https://wiki.php.net/rfc/mysqli_quote_string

https://wiki.php.net/rfc/limit-maximum-number-of-filter-chains

JSON Performance Improvements

There are performance improvements as well, including faster JSON encoding of arrays and objects, and better performance when using json_encode() with PHP_JSON_PRETTY_PRINT.

True Async: A Direction to Watch

Another area to watch is True Async, which prepares PHP to compete with other languages that natively support concurrent tasks, services, and I/O operations. For IBM i teams, that direction is worth watching as PHP continues to be used for more than traditional web pages.

PHP 8.2 End of Life Is Approaching

While PHP 8.6 develops, PHP 8.2 is approaching end of life. Its security support ends on December 31, 2026. After that, PHP 8.2 will no longer receive upstream security fixes from the PHP project.

Running an end-of-life PHP version can create security exposures, audit concerns, dependency problems, and a harder migration later.

The best approach is to stay current before the situation becomes urgent.

How Seiden Group Can Help

With Seiden PHP+ Server and our support services, we help clients plan PHP migrations, resolve compatibility issues, and keep production environments stable. We also contribute directly to PHP’s future, as Calvin’s RFC demonstrates.

PHP 8.6 brings improvements, while staying current protects your applications, reduces risk, and keeps your IBM i environment ready for the future.

If you are running PHP 8.2 or older releases, or are not sure which PHP versions you have, now is a good time to review your options. Contact Seiden Group to assess your current PHP setup, plan your next migration, and keep your applications secure and supported.

Alan Seiden

Safer npm installation is on the way for Node.js (and all JavaScript)

/0 Comments/in /by

JavaScript’s package manager, npm, has been in the news lately for allowing supply-chain risks. By default, npm trusts a module’s install scripts, running them automatically. In a recent compromise of Red Hat npm packages, attackers used malicious install scripts to spread a credential-stealing worm.

Some packages do need to run installation scripts. The odbc module, for example, uses node-gyp during installation to compile the driver. On IBM i and other platforms, that compile step may be necessary.

npm’s response

Starting with npm 11.16.0, npm will warn about install scripts that have not been explicitly approved. In npm 12, unapproved scripts are expected to be blocked by default.

If you try to install a package with install scripts under npm 11.6.0, you will receive a warning such as this:

For legitimate packages that need install scripts, the fix is to run npm approve-scripts. For example:

After approval, npm will remember that the package should be allowed to run its install script:

In our case, approving odbc is appropriate because its installation runs node-gyp, which is needed to compile the ODBC driver.

We suggest updating npm now and reviewing any warnings before npm 12 makes this behavior more strict.

To upgrade npm to the latest version:

Thank you to IBM’s Korinne Adler for alerting us to this change.

For more open source support and security help

Contact us for professional open source support and security guidance.

Alan Seiden

IBM i: A Natural Platform for Agentic AI

/1 Comment/in /by
Adam Shedivy and Jack Woehr at PowerUp 2026

Adam Shedivy and Jack Woehr at PowerUp 2026

At the April 2026 COMMON PowerUp conference in New Orleans, IBM’s Adam Shedivy presented a compelling vision of IBM i as an “agentic-native” operating system. Adam observed that IBM i’s integrated architecture provides what agentic AI needs: business data, operations, security, authority, and auditability.

Let’s see what makes IBM i an agentic-native platform.

Integration is the key

While useful for humans, the integrated nature of the IBM i platform becomes even more potent for agentic AI. Here, the operating system, Db2 database, object model, user profiles, job management, command environment, security model, audit journals, and system services are part of the same platform.

As a result, authorized agents can observe, understand, and take action, all within established, governed interfaces, rather than a loose collection of disconnected tools.

SQL services add even more consistency for agents

Using the growing collection of IBM i Services and Db2 for i Services, agents can query system information with SQL instead of relying on green-screen commands.

For agents, SQL Services create a consistent interface to the platform that can help answer questions such as:

  • Which jobs consumed the most CPU overnight?
  • Which user profiles have authority settings that deserve review?
  • What changed on the system recently?
  • Why did a particular order, invoice, or batch process fail?

Security Must Be Enforced by the Platform

Agentic AI becomes risky when an agent can act without boundaries. Although a prompt can suggest that an agent not access payroll data, a better design is to run the agent under an identity that cannot access payroll data.

IBM i has a mature security model that controls access in a consistent manner throughout the database and the operating system itself, with additional database safeguards such as Row and Column Access Control (RCAC). These controls are enforced universally for all users and applications, including AI agents.

A new view of IBM i in the agentic era

As we all move forward modernizing our applications, we leverage IBM i as a near-ideal environment for putting agentic AI to work, even being “agentic-native,” as Adam Shedivy puts it.

We can help you get started with AI with IBM i. Get in touch for an AI strategy session or for any other assistance in turning old AS/400 perceptions to modern IBM i power.

Alan Seiden

Your “AS/400” Is a Modern IBM i Platform

/9 Comments/in /by

During a recent client visit, a executive told me that his company was still running an AS/400. His employees had criticized the system as outdated and risky. He defended it because it was stable and reliable, but he also seemed to accept the idea that it was old.

I explained that while the company may once have had an AS/400, today they were running IBM i on Power hardware. They were using it like an old system, but it is modern technology, capable of much more. The executive was pleased and wanted to learn more.

Backward-compatible and future-powered

IBM i’s compatibility with older applications is one of its strengths. A company can continue running proven green-screen software while supporting newer technologies and business requirements.

I reminded the executive that his IBM i system was already running some modern applications, including a PHP-based web portal. What’s more, his system had the potential to integrate with outside services, such as payroll, shipping, customer portals, reporting tools, and other systems through APIs.

IBM i offers an integrated design. The operating system, Db2 database, security model, work management, and application environment work as a team. This architecture supports IBM i’s reliability, data integrity, and security, making it attractive to varied businesses, including retailers, banks, manufacturers, distributors, and insurance companies.

That does not mean every IBM i environment is automatically modern. Some applications need modern web interfaces or API architecture. Integrations may need to be improved. Some systems need updated table design, security practices, newer open source tools, or better development workflows.

AI Potential

As companies explore AI, IBM i systems offer more than the trusted business data and rules that AI tools would need to access. IBM i offers a consistent, integrated, secure environment with a world-class database and a universal SQL interface. As a result, I’ve heard IBM i described as “the first agentic-native operating system.”

Going from AS/400 to IBM i

If you can imagine it, you can do it on IBM i. Backward compatibility lets you move at your own pace.

Now is the time to dream big, call the platform by its right name, and use the power that IBM has given us with this fascinating business platform.

Contact the Seiden team to explore new possibilities for your IBM i applications.

Alan Seiden

MCP + AI for IBM i Teams (with a MongoDB example)

/0 Comments/in /by

The Model Context Protocol (MCP) standard defines how AI tools connect to systems such as databases, services, and internal utilities. Instead of every AI product inventing its own custom connector, MCP provides a standard interface.

A good example comes from Seiden Group’s Jack Woehr in his article A Simple MongoDB MCP Server Agent. Jack was also just named MongoDB Creator of the Month. (MongoDb is a flexible NoSQL database that can manage large amounts of unstructured or semi-structured data.)

If you’re attending conferences this year, Jack will be talking about AI at NEUGC (April 7–9, 2026) and at COMMON POWERUp 2026 (April 27–30), where his sessions include “Using Large Language Models” and “AI on Power.”

Why IBM i teams should care

Most IBM i shops already live in a hybrid world: RPG + Db2 + CL alongside open source, APIs, web apps, and, increasingly, AI. MCP matters because it points toward a future where:

  • you don’t need a one-off integration for every AI experiment
  • you can put governance and guardrails around what AI can touch
  • you can modernize incrementally, bridging systems instead of rewriting them

MCP fits for IBM i because it helps make AI integration projects more standardized and repeatable.

How Seiden Group can help

At Seiden Group, we’re focused on practical modernization and development. If you’re exploring any mix of:

  • AI enablement (use cases, architecture, guardrails)
  • MongoDB in a hybrid IBM i environment
  • IBM i development and modernization (RPG, COBOL, SQL, APIs, open source)

We can help you evaluate options, build proof-of-concept projects, and implement production-ready solutions.

Get in touch to chat with us about your options.

Alan Seiden

GnuPG PHP Extension for IBM i: Now Included with Seiden Support

/0 Comments/in /by

GnuPG logoAt Seiden Group, we listen to client requests that keep their IBM i applications secure, modern, and practical.

Recently, a customer asked us to port the GnuPG (GNUPG) PHP extension to IBM i. This extension is now available to Seiden Support subscribers.

Read more →

Amy Lantz

Getting Started with Code for IBM i: A Lunch & Learn Video

/0 Comments/in /by

On October 29, 2025, Alan teamed up with Susan Gantner and Jon Paris for an educational Lunch & Learn focused on two timely IBM i development topics: VS Code for i and RPG arrays.

Read more →

Alan Seiden

Seiden PHP+ Delivers PHP 8.5 to IBM i

/0 Comments/in /by

PHP on IBM iEach year brings a new PHP release. We’ve prepared Seiden PHP+ so that IBM i users can adopt PHP 8.5 shortly after it becomes generally available (GA) around November 20, 2025. As I mentioned in Keep Your PHP Secure: Why Regular Updates Matter, PHP users should adopt a regular upgrade schedule to make upgrades easier.

November 20, 2025 UPDATE
PHP 8.5 and Seiden PHP+ 8.5 are both available as of today.

Notable Enhancements in PHP 8.5

Two updates stand out to me:

Read more →