 TweetDeck today suffered a major security bug. Amazing what some people can do in 140 characters. I'm Adrienne Jeffries and this is 90 Seconds on the Verge. Today, a newly discovered vulnerability in some versions of TweetDeck allowed attackers to remotely execute JavaScript code. It seems to have started innocuously enough, with users seeing random pop-up windows reading YO or please close TweetDeck. But some coders soon realized how to trigger the retweet command, causing more TweetDeck users to spread the code further. Many popular accounts were hit, including the New York Times, Central Park, and the BBC. Soon after the news broke, TweetDeck took the service down as it assessed the security issue. Service returned an hour later after TweetDeck said it had verified the security fix. Okay, so what exactly is going on here? In short, the issue has to do with cross-site scripting, or XSS. Let's say someone writes a bit of JavaScript code into a tweet. A Twitter client is supposed to convert that into harmless plain text. But something went amiss and TweetDeck was instead executing the code as written. All it had to do was show up in your TweetDeck's timeline. One of the earliest examples we found was from a 19-year-old Austrian teen named Florian from around 8 this morning. He soon reported it publicly to TweetDeck, which potentially alerted anyone who monitored the account's mentions. The small silver lining here is that the JavaScript is limited to what TweetDeck itself is allowed to do. So while Twitter might be a mess, your local files and Gmail accounts should be okay. For more on Twitter and the web at large, check out The Verge. Coming up tomorrow, we must seek answers for what comes after the 90th second. Wait, what? Is it always TweetDeck, or not?