[josh2600]

Joe Sullivan, Director of Security at Facebook said publicly during the SF New Tech Security event this Wednesday that Facebook purchased the Java 0Day run in their training exercise[1]. I guarantee that 0Day was more than $5000.

[1]http://arstechnica.com/security/2013/02/at-facebook-zero-day...

[tptacek]

It may have been, it may not have been (we don't know the terms), but it was a clientside driveby RCE, not a web app bug.