We changed the title because "Mark Zuckerberg's private friends list discovered" is shameless linkbait and added a question mark because the nature of this vulnerability is in dispute.