A Bitly security flaw let bad actors hijack years-old links on high-profile X accounts this weekend — and the establishment press is already framing it as an X problem to pressure the one major platform that still allows open discourse.
Links dating back to 2009 from URL-shortening service Bitly were repurposed to redirect users to unrelated and often offensive destinations. A 2011 Burger King post about restaurant locations now points to a Wikipedia page on Nazi concentration camps. Another Burger King tweet redirects to Adolf Hitler's Wikipedia page. A McDonald's post from 2011 was altered to link to the September 11 attacks page. Roughly a dozen to 20 posts from Donald Trump's account — hit the hardest — now redirect to pages ranging from "Fortnite baby" images to Epstein files references and video game clips, according to CNN and the New York Post.
The mechanism is straightforward and has nothing to do with X's infrastructure: Bitly links don't automatically expire, and when the original destination goes inactive, bad actors can repurpose those shortened URLs. Bitly acknowledged the issue Sunday, stating it had "identified an issue that allowed bad actors to repurpose certain old, inactive links to redirect people to content unrelated to the original posts." The company said it suspended the responsible accounts and is working to disable affected URLs.
This is link rot — a well-known internet phenomenon. As one Reddit user noted, per the New York Post: "Websites go down, link shorteners expire, addresses move, so over time, old links stop pointing to where they once pointed. Malicious people, or just people who think they're funny, can then buy or otherwise acquire these expired domains, and redirect them elsewhere."
Ari Lightman, a digital media professor at Carnegie Mellon, told CNN that Bitly links may be susceptible to artificial intelligence scans and exploitation mechanisms, and that unmonitored social media accounts create vulnerabilities. "You have a variety of vulnerabilities that people can utilize for exploitation," Lightman said. "It's just finding these old messages out there and sort of repopulating them."
CNN framed its headline around "vulgar, racist or random websites" — emphasizing the most offensive redirects while burying the fact that this is a Bitly infrastructure failure, not an X content moderation failure. The New York Post more accurately identified the scheme as a "Bitly link-hijacking" issue. @StopAntisemites on X called out Burger King directly: "Hiring a competent social media team is one of the most important hiring decisions a company can make. Case in Point."
The affected links appear confined to posts made between 2009 and 2014. Other public figures hit include Bill Gates, Justin Trudeau, and Mike Pence — but CNN's coverage led with Trump and emphasized his account above all others.
The real vulnerability here is third-party link services that control the destination of URLs embedded in social media posts — a structural problem across every platform. The question is whether the press will honestly identify that, or use it as another pretext to demand Musk silence more speech on X.
