The bug works on iPhones and iPads running iOS 12.1, and Apple PCs are running MacOS Mojave, which has recently added Group FaceTime feature.
It is activated when you call someone via FaceTime, swipe up to add another person to the call, and add your own phone number. The person who initiated the call is then able to hear the live audio on the other person's phone, even though the recipient has not accepted the call. And their screen gives no indication that their conversation is being transmitted.
CNN's senior editor Brian Ries has successfully used it on friends, family members and a colleague, and in one instance what even to see video.
To avoid falling victim to the bug, disable FaceTime on Apple's software updates have been released.
On iPhone or iPad, go to Settings -> FaceTime, and toggle off the green button at the top of the screen. To turn it off on a Mac, open the FaceTime app and go to FaceTime on top of the screen, then select "Turn FaceTime Off."