InfoSecBulletin Cybersecurity for mankind
A vulnerability in Twitter’s code was recently discovered that allows users to game the algorithm with mass blocking actions from large numbers of accounts, in an effort to suppress specific users showing up in people’s feeds — essentially, it allows bot-created “shadow bans” in the parlance of social media censorship critics.
Now, the flaw has been assigned a CVE number as an officially recognized security vulnerability: CVE-2023-29218.
“PentestCode” AI Agent Automating Penetration Testing with 18 Tools
CVE-2026-60137, CVE-2026-63030
Patch immediately! 2 high severity WordPress flaws found
Windows LegacyHive 0, AWS, Fortinet, TP-LINK multiple flaws got hackers attention
CVE-2026-53412
Zoom Warns of critical account takeover Flaw via Network Access
India to built Mythos-like AI model “Sarvam AI” and “BharatGen” assigned
Cursor, SonicWall, SharePoint 0-day exploited to the wild
Microsoft Patch Tuesday July-2026 fixes 570 flaws, 3 zero-days
Fortinet Patches 7 Flaws In FortiOS, FortiProxy, FortiPAM, and FortiSandbox
CISA warns Cisco IOS flaw, while VMware flaw allows bypassing authentication
Meta’s louisiana data center to exceed 250 billion price tag
“The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023,” the MITRE CVE entry explained.
The vulnerability was first flagged by infosec researcher Federico Andres Lois after analyzing Twitter’s source code, which was leaked to the public and later posted on GitHub by Twitter as part of its commitment to transparency.
The bug means that botnet armies have the ability to game the algorithm with mass blocks, mutes, abuse reports, spam reports, and unfollows to drive down the number of times specific accounts show up in Twitter’s recommendation engine.
“The current implementation allows for coordinated hurting of account reputation without recourse,” Lois wrote in his disclosure. “Any other time I would just report this information using a vulnerability channel, but given that this is already popular knowledge there is no use to do so.”
The vulnerability has since been discovered by others, prompting a cryptic, yet splashy, response from Twitter CEO Elon Musk.
“Who is behind these botnets?” Musk tweeted. “Million dollar bounty if convicted.”
