Nothing is supposed to show up on your Facebook Wall unless it's posted by you or your friends, but it can happen, as Khalil Shreateh just proved.
By posting on Mark Zuckerberg's wall.
Shreateh, a security researcher from Palestine, first reported the bug to Facebook, which pays people to report such things rather than sell them on the black market.
But, instead of fixing the bug and paying the researcher the $500+ fee, Facebook told him "this was not a bug," according to an email that Shreateh shared.
When he tried a second time to warn the company and was rebuffed, Shreateh posted on the Wall of Sarah Goodin - a friend of Facebook CEO Zuckerberg.
That got their attention REALLY fast.