A security flaw on Twitter.com has been exposed, which lets users post onMouseOver JavaScript code to make content pop-up right on the site. "Messages are also spreading virally exploiting the vulnerability without the consent of users," says security expert Graham Cluley at Sophos. "Thousands of Twitter accounts have posted messages exploiting the flaw. Victims include Sarah Brown, wife of the former British Prime Minister.