Yeah, you got it right, the Twitter API changed and broke the WordPress wp-include. The following fix worked for me but required re-saving the post in question.
add_filter( 'oembed_providers', 'twitter_hotfix' );
function twitter_hotfix( $providers ) {
$providers['#https?://(www\.)?twitter\.com/.+?/status(es)?/.*#i'] = array( 'https://api.twitter.com/1/statuses/oembed.{format}',\
true );
return $providers;
}
The big change seems to involve forbidding non-https connections.