The timing of this hack, and the fact that Twitter was (at least at one point) a Rails app, and still uses Ruby on the front end, makes me think this is likely a YAML vulnerability exploit. Can anyone confirm/rule this out?
I don't think they were vulnerable to that particular exploit. I know someone who ran the Metasploit Rails XML/YAML vulnerability scanner against Twitter.com almost immediately after its released, suspecting that they might be vulnerable. They were not.
The main site itself was very unlikely to be vulnerable, but support apps, internal apps, etc. are all vectors.