Update: Twitter says it has fixed a dangerous flaw that turned the Twitter Website into minefield Tuesday of potentially dangerous links. The company tweeted early Tuesday “The XSS attack should now be fully patched and no longer exploitable.”
Earlier in the day a security flaw turned Twitter’s Website into a chaotic and potentially unsafe place, filled with annoying pop-up windows that activated just by rolling the mouse over another user’s tweets.
But according to Sophos, the Twitter hack could be used to send people to malicious third-party Websites. Sarah Brown, wife of former U.K. Prime Minister Gordon Brown, for example, has inadvertently sent users to a Japan-based hardcore porn Website.
Twitter originally said it was working on the problem. Georg Wicherski of Kaspersky Labs notes that “Twitter now properly escapes links, that specific vulnerability seems closed.”
For now, Twitter users should either access the site from a third-party client, such as TweetDeck or Seesmic, or use mobile.twitter.com, to which the exploit does not apply.
Users who were already granted access to the new, redesigned Twitter.com should not run into this exploit.