Facebook subsidiary patches 'very scary vulnerability' that infected phones via missed WhatsApp calls alone