Facebook has revealed that a software bug exposed the photos of up to 6.8 million users, including pictures they had not posted. It made the announcement a day after hosting its pop-up privacy experience It's Your Facebook in New York's Bryant Park.