Twitter has confirmed that a code vulnerability resulted in a security breach that allowed bad actors to obtain data on at least 5.4 million accounts.