Facebook announced a security breach which is a software bug in one of its APIs exposing photos of up to 6.8 million users, including private photos not yet posted on the platform.
It made the announcement a day after hosting its pop-up privacy experience “It’s Your Facebook” in New York’s Bryant Park and it blamed this new leak on a Photo API bug that was present in its backend code between September 13 to September 25, 2018.

The company said that several third-party apps had access to “a broader set of photos than usual” for the 12 days in September.
Tomer Bar, a Facebook developer, provided this explanation about the Photo API bug leak:
“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline. In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.

The bug also impacted photos that people uploaded to Facebook but chose not to post. For example, if someone uploads a photo to Facebook but doesn't finish posting it - maybe because they've lost reception or walked into a meeting - we store a copy of that photo so the person has it when they come back to the app to complete their post.”

Bar also stated that Facebook investigation revealed that 1,500 apps built by 876 developers might have been able to access the non-public photos of up to 6.8 million users. It is unclear if any of these apps abused the bug to actually access and download users' private and non-posted photos.

The company said it would notify affected users. This includes users who installed any of the 1,500 apps and gave the app permission to access their photos.
Facebook users can check if they are affected Users and not to wait for the company to send them notification.

I hate Facebook