Odaily Planet Daily reports, according to 1M AI News monitoring, the 360 security team has responded to the wildcard certificate and private key leak incident involving OpenClaw, stating that it was a business error to include internal domain certificates in the installation package. The affected certificate, *.myclaw.360.cn, resolves to the local loopback address 127.0.0.1 and is used only on users' local machines, providing no external services.
After receiving reports from multiple security researchers, 360 has applied for the revocation of this certificate, which is now expired and can no longer be used for any legitimate HTTPS encrypted communication; ordinary users are unaffected. The theoretical risk of man-in-the-middle attacks during the period of exposure still exists, but since the service associated with this certificate ran only in a local environment, the actual risk is relatively limited.
Previous message: The OpenClaw assistant package from 360 leaked an SSL private key; Zhou Hongyi previously promised, "Never leak passwords."