A Twitter user has demonstrated a cross-site scripting (XSS) vulnerability on the microblogging platform that could allow an attacker to take over users' accounts or spread malware. Read the full article

An important milestone that should compel all  social networks to be much more diligent about preserving  privacy and providing robust security was established by federal regulators with Twitter. Read the full article

Oil giant BP suffered further embarrassment after its official Twitter account was hacked. Pranksters purloined the @BP_America Twitter account to write "Terry is now in charge of operation Top Kill, work will recommence after we find a XXL wetsuit. #bpcares #oilspill". Read the full article

The Hybris worm, circa 2000, self-updated by posting encoded messages to the alt.comp.virus newsgroup. Fast forward a decade later and a new botnet kit is trying a similar trick - using Twitter as the command and control channel for its bots. But apparently the author of this TwitterNet Builder didn't really think things through. It only works if you post the commands using a public Twitter account - easily searchable and even easier removed.

In fact, the folks at Sunbelt have already searched out the handful of Twits and reported it to Twitter. For details and pics, see their post "The DIY Twitter Botnet Creator

The cybercriminals behind the intensifying phishing scam that has been plaguing Twitter since late last week are proving how easy it is to pervert the trust social networks like Twitter and Facebook along with search giant Google have made a cornerstone of their respective business models. The idea is to get Web users accustomed to using their Twitter, or Gmail or Facebook credentials as  a “single sign-on” to access the Web’s coolest apps. Read the full article