Latest Facebook bug exposed up to 6.8 million users’ private photos

By Arif Bacchus Published December 14, 2018

Image used with permission by copyright holder

With the latest Facebook API bug, up to 6.8 million consumers on the social network had their private photos inappropriately exposed to third-party apps. Though the issue has since been fixed, some of the apps had access to photos for the 12 days between September 13 and September 25.

Users impacted had already authorized and granted special permissions to these apps to access content from their Timeline, but the bug led developers to access photos that were uploaded but never yet posted on the Marketplace or Facebook Stories. Though Facebook isn’t specifically giving names, it says up to 1,500 apps from 876 developers were affected. Facebook also notes it had approved photos API access for these apps, issuing an apology promising more change.

Mockup of the alert (Image via Facebook) Image used with permission by copyright holder

“We’re sorry this happened. Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug. We will be working with those developers to delete the photos from impacted users,” said Tomer Bar, engineering director at Facebook.

Recommended Videos

Facebook will be alerting impacted consumers with a notification, which will then direct them to the Help Center where they can see if they’ve used any apps that were impacted by the bug. It also is recommended for consumers to individually log into apps to check and see if they’ve wrongfully obtained any photos permissions. A sample notification and interface of what consumers will end up seeing can be seen to the left.

It is not clear when Facebook first was made aware of this API bug. TechCrunch reports that Facebook discovered and fixed it on September 25, but took its time to investigate so it can warn impacted users. That report also makes it clear that photos shared through Facebook Messenger were not impacted.

This would not the first Facebook-related problem in recent months. Back in November, hackers were attempting to sell 120 million private Facebook messages, though that was related to third-party extensions. Before that, up to 50 million accounts were also compromised due to a flaw in access tokens and the “View As” feature. The social media website also apparently knew about Russia data harvesting on its platform since 2014, according to seized documents.

Former Computing Writer

Arif Bacchus is a native New Yorker and a fan of all things technology. Arif works as a freelance writer at Digital Trends…

Topics

Computing

The 10 best VPN services for 2026, reviewed by experts

Our 2026 picks cover everything from privacy and streaming to speed, free plans, and unlimited device support.

VPN on a phone

In 2026, there is no shortage of choices when it comes to a VPN service. Most of the big names now offer strong encryption, large server networks, streaming support, and apps for nearly every major platform. The differences show up in speed, privacy policies, ease of use, pricing, device limits, and the extra features bundled on top.

We tested and compared leading VPN services to find the best options for different users, whether you want fast streaming, more privacy features, unlimited device support, or a free service that doesn't make too many compromises.

Computing

Safari’s biggest tab-management upgrade in years could finally end your browser clutter with iOS 27.3

Safari learns to tame tabs and dim bright pages.

Here’s a confession: I never close my browser tabs. I just let them pile up until my browser looks like a Tetris game I’ve already lost. Well, it looks like Apple is finally ready to help me clean up.

Apple’s first iOS 27.3 developer betas are here, and they add three new Safari features: Vertical Tabs, Adaptive Dark Mode, and Siri commands. It’s the one I’m most excited about.

Computing

Google is making schools choose between AI and access to its Search engine

Google is using its Search dominance to armtwist schools into accepting AI

Google says it wants to give schools more control over how students use AI. But its proposed solution comes with a rather extraordinary condition: schools that opt to block AI entirely will also lose access to Google Search on student accounts. The conclusion is that schools can say no to Google’s AI, but they may have to give up one of the most fundamental tools students use to learn and research online.

The change, reported by The New York Times, is expected to take place early next year. Google is responding to concerns from parents and educators who want more control over how children interact with AI, the company said. But linking access to Search to acceptance of AI raises an uncomfortable question: is Google really giving schools a choice, or making it harder for them to say no?