360 Responds to Security Lobster Private Key Leak: Caused by Business Mishap, Certificate for This Machine Only Has Been Revoked

SmartContractAuditor · 2026-03-17T07:21:52+00:00

The 360 Security team responded to the OpenClaw wildcard certificate and private key leak incident, stating it was a business error. The leaked certificate was only used locally and does not affect external users. The certificate has been requested for revocation, and the risk is limited.

SmartContractAuditor

2026-03-17 07:21:52

Abstract generation in progress

Odaily Planet Daily reports that according to 1M AI News monitoring, the 360 Security Team responded to the security incident involving the OpenClaw wildcard certificate and private key leak, stating that it was a business mistake to include the internal domain certificate in the installation package. The affected certificate *.myclaw.360.cn actually resolves to 127.0.0.1, the local loopback address, used only on the user’s machine and not providing any external services.

After receiving reports from multiple security researchers, 360 has applied to revoke the certificate. The certificate is now invalid and can no longer be used for any legitimate HTTPS encrypted communication. Ordinary users are unaffected. While there remains a theoretical risk of man-in-the-middle attacks during the leak period, the actual risk is relatively limited since the certificate’s associated service only runs in the local environment.

Previous news: 360’s OpenClaw assistant installation package leaked SSL private keys; Zhou Hongyi previously promised “never to leak passwords.”

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes