Several high-profile Twitter accounts have been briefly hijacked to expose alleged flaws in the service.
The accounts of Eamonn Holmes, Louis Theroux and several others briefly showed messages saying they had been taken over by Insinia Security.
In a blog, the firm said it managed the feat by analysing the way Twitter handles messages posted by phone.
Knowing a person’s phone number could let attackers send messages from accounts they do not control, it said.
It recommends that Twitter users remove their phone number from their accounts as a precaution.
Other celebrities whose accounts it temporarily hijacked included the travel journalist Simon Calder and the TV presenter Saira Khan.
Insinia said it had repeatedly warned about the problem in the past.
But it has faced criticism for its latest attempt to publicise the issue.