Update. The bug has been patched and rolled out. In addition, Twitter has added two new features to the updated interface: Reply to All and auto-complete for Twitter names.
We’ve identified and are patching a XSS attack; as always, please message @safety if you have info regarding such an exploit.
We expect the patch to be fully rolled out shortly and will update again when it is.
Update (6:50 PDT, 13:50 UTC): The exploit is fully patched.
She first posted a warning on her page to try to protect visitors, saying “don’t touch the earlier tweet – this twitter feed has something very odd going on ! Sarah.” Her profile now shows up as protected. Not sure if it was always so or if this is a more drastic attempt to protect her followers.
At the time of this writing, there has been no statement issued from Twitter and, in my testing, the exploit is still active. There are a few ways to protect yourself, but first and foremost is to completely stay off of Twitter.com. It appears that the exploit only works if you haven’t been upgraded to the new Twitter interface, but better safe than sorry. Also, if you are using a third-party client like Tweetdeck, you should be in the clear.
Many affected tweets appear as a black box or in rainbow colors. This is a red flag as the colors hide the content of the tweet, but all affected tweets are not hidden this way. If you absolutely must use Twitter using the old interface at Twitter.com, avoid moving your mouse cursor into the tweet area. It’s very easy to activate these things and, if Twitter doesn’t do something about it quick, it’s only a matter of time before someone gets creative.
With most users still using Twitter via the web interface, this is a serious issue that needs to be resolved immediately. It’s very surprising that a bug this simple wasn’t caught in testing and is only being discovered now. (Update: This flaw was corrected a month ago, but was re-introduced in a recent update completely unrelated to the new Twitter)