According to AppleInsider, an exploit allows a FaceTime Video caller to hear the audio from a recipient’s iPhone without the call even being picked up. And Apple has disabled Group FaceTime until the flaw is fixed.
Here’s how it works (though apparently Macs are safe): the caller starts a FaceTime video call with a contact. While the call is “ringing,” the caller adds themselves manually to the call by tapping Add Person then entering the phone number that the call is being made from. A Group FaceTime call is started with the caller, with the original recipient’s audio streaming before the call is accepted.
In a statement to BuzzFeed confirmed it is aware of the issue and has “identified a fix that will be released in a software update later this week.”