The should part worries me though, if not even Facebook has details on this, then it should have probably been patched the first day