https://kirkabbott.com Cloud, AI, and security: long-form articles. en-us https://kirkabbott.com/writing/2026-10-31-nist-already-publishes-a-csf-map-to-the-owasp-llm-top-10 https://kirkabbott.com/writing/2026-10-31-nist-already-publishes-a-csf-map-to-the-owasp-llm-top-10 Sat, 31 Oct 2026 00:00:00 GMT NIST publishes 169 mappings from the Cybersecurity Framework to the OWASP Top 10 for LLM Applications, then ships them inside an XLSX download whose URL says json and whose contents include 91 withdrawn elements from CSF 1.1. Here is what the data actually says once you get it out. nist-csf owasp-llm compliance https://kirkabbott.com/writing/2026-10-03-a-failed-deploy-a-critical-cve-and-the-upgrades-i-kept-putting-off https://kirkabbott.com/writing/2026-10-03-a-failed-deploy-a-critical-cve-and-the-upgrades-i-kept-putting-off Sat, 03 Oct 2026 00:00:00 GMT Vercel retired Node 20 and my deploys stopped. Fixing that surfaced a critical Next.js advisory, two pages shipping data no one ever saw, and, eventually, the move to Next 16, React 19 and Tailwind 4. The test suite stayed green throughout. A screenshot diff did not. next-js cves tailwind https://kirkabbott.com/writing/2026-09-07-prompt-injection-in-a-voice-pipeline https://kirkabbott.com/writing/2026-09-07-prompt-injection-in-a-voice-pipeline Mon, 07 Sep 2026 00:00:00 GMT I built a scam-call detector on AWS where a caller's own words become input to an LLM. That makes the caller an untrusted author of model input, which is the part most write-ups skip. Here is where the injection surface actually sits, the four things I put in front of it, and why only the last one really matters. ai-security cloud-security threat-detection https://kirkabbott.com/writing/2026-08-07-per-user-encryption-keys-length-extension-and-hkdf https://kirkabbott.com/writing/2026-08-07-per-user-encryption-keys-length-extension-and-hkdf Fri, 07 Aug 2026 00:00:00 GMT The 'obvious' way to derive per-user encryption keys from a master secret is SHA256(master || user_id). It's wrong in a specific and exploitable way. Here's the attack, and how HKDF fixes it. cryptography kdf hkdf https://kirkabbott.com/writing/2026-07-10-how-14-cves-finally-forced-our-nextjs-upgrade https://kirkabbott.com/writing/2026-07-10-how-14-cves-finally-forced-our-nextjs-upgrade Fri, 10 Jul 2026 00:00:00 GMT I deferred the Next.js 14 to 15 upgrade for over a year. Then a security audit counted 14 high-severity CVEs sitting in my production next package. Every code change, every build-pipeline gotcha, and the lessons that came out of it. next-js cves https://kirkabbott.com/writing/2026-06-12-why-im-betting-on-cloud-ai-security https://kirkabbott.com/writing/2026-06-12-why-im-betting-on-cloud-ai-security Fri, 12 Jun 2026 00:00:00 GMT The strategic case for specializing in the cloud and AI security intersection. Three legs of the bet, what makes the seam between them actually new, and the under-served third piece nobody is building yet. cloud-security ai-security https://kirkabbott.com/writing/2026-06-09-trends-in-the-cybersecurity-industry https://kirkabbott.com/writing/2026-06-09-trends-in-the-cybersecurity-industry Tue, 09 Jun 2026 00:00:00 GMT AI, zero trust architecture, and software supply chain attacks are reshaping modern cyber operations. This paper examines all three and argues that provenance-based build controls should replace the SBOM-centric compliance posture inherited from 2021. ai-security zero-trust supply-chain https://kirkabbott.com/writing/2026-05-15-a-bad-week-to-ship-next-latest https://kirkabbott.com/writing/2026-05-15-a-bad-week-to-ship-next-latest Fri, 15 May 2026 00:00:00 GMT Three CVEs, one almost-mistaken major version jump, and a build cache that kept lying to me. Notes from patching dependency vulnerabilities on a brand-new Next.js site within hours of going live. cloud-security supply-chain next-js