The article claims for Twitter a "zero-day" without giving any details. Is this better or worse than "mistakes were made"?
"Today, Twitter has confirmed that the vulnerability used by the threat actor in December is the same one reported to and fixed by them in January 2022 as part of their HackerOne bug bounty program."