{"id":771,"date":"2021-07-08T07:21:02","date_gmt":"2021-07-08T12:21:02","guid":{"rendered":"https:\/\/www.knownhost.com\/kb\/?p=771"},"modified":"2026-01-23T14:57:49","modified_gmt":"2026-01-23T20:57:49","slug":"what-is-memcrashed-and-how-do-i-fix-it","status":"publish","type":"post","link":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/","title":{"rendered":"What is Memcrashed and how do I fix it?"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 ez-toc-wrap-right counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #212121;color:#212121\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #212121;color:#212121\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#memcached\" >Memcached<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#memcrashed\" >Memcrashed<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#getting_ampd\" >Getting Amp&#8217;d<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#memcrashed_%e2%80%9ckill-switch%e2%80%9d_and_data_theft_andor_corruption\" >Memcrashed &#8220;Kill-Switch&#8221; and Data Theft and\/or Corruption<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#what_can_i_do\" >What Can I Do?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#how_can_i_secure_my_memcached_installation_by_editing_the_existing_configuration\" >How Can I Secure My Memcached Installation By Editing the Existing Configuration?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#installing_and_securing_memcached_for_easyapache_4_centos_7cpanel_servers_everything_you_need_to_know\" >Installing and Securing Memcached for EasyApache 4 CentOS 7\/CPanel Servers: Everything You Need to Know<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#cpanel_and_memcached\" >cPanel and Memcached<\/a><\/li><\/ul><\/nav><\/div>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"memcached\"><\/span>Memcached<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Memcached is a memory object caching system for speeding up dynamic web applications\u2026 It&#8217;s open source and has been designed to work with a large number of open connections. Database calls,&nbsp;API&nbsp;calls, or page rendering are a few examples of the arbitrary data results that are stored in memory to alleviate database load. One can see why it has been so popular for caching. Its popularity also means that is potential for use as an attack vector is greater simply because it is more available to weaponize.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"memcrashed\"><\/span>Memcrashed<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>A critical vulnerability in Memcached was discovered in February of 2018 that allows attackers to launch and execute powerful DDoS amplification attacks.&nbsp;<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-1000115\">Learn more about other vulnerabilities<\/a>&nbsp;This vulnerability has been described as a &#8220;new chapter in DDoS attack executions\u201d by Ashley Stephenson, CEO of Corero Network Security. Corero Network Security is the security company that found a &#8216;kill-switch&#8217; for these attacks. Here is her complete statement:<\/p>\n\n\n\n<p>\u201cMemcached represents a new chapter in DDoS attack executions. Previously, the most recent record-breaking attacks were being orchestrated from relatively low bandwidth Internet of Things (IoT) devices. In contrast, these Memcached servers are typically connected to higher bandwidth networks and, as a result of high amplification factors, are delivering data avalanches to crippling effect. Unless operators of Memcached servers take action, these attacks will continue.&#8221; www.corero.com\/blog\/corero-network-security-discovers-memcached-ddos-attack-kill-switch-and-also-reveals-memcached-exploit-can-be-used-to-steal-or-corrupt-data\/<\/p>\n\n\n\n<p>This vulnerability was dubbed &#8220;Memcrashed&#8221; by Cloudflare and is responsible for a 1.35 Tbps DDoS that hit Github February 28, 2018,&nbsp;<a href=\"https:\/\/githubengineering.com\/ddos-incident-report\/\">February 28th DDoS Incident Report<\/a><\/p>\n\n\n\n<p>A few different PoC exploit codes have been released, one of which utilizes the Shodan search engine&nbsp;API&nbsp;to obtain a fresh list of vulnerable Memcached servers each time. The Shodan engines show 29,411 servers still unpatched as of June 16th, 2018.<\/p>\n\n\n\n<p><a href=\"https:\/\/thehackernews.com\/2018\/03\/memcached-ddos-exploit-code.html\">Memcached DDoS Exploit Code and List of 17,000 Vulnerable Servers Released<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.shodan.io\/search?query=11211\">Shodan Search<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/649\/Memcrashed-DDoS-Exploit\">MEMCRASHED DDOS EXPLOIT TOOL(GitHub)<\/a><\/p>\n\n\n\n<p>We&#8217;ve done a great job taking care of this threat overall as a community, but there is still work to be done. Many reports were previously reporting approximately 95,000 to 100,000 vulnerable servers. We must remain proactive in identifying these servers and securing them!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"getting_ampd\"><\/span>Getting Amp&#8217;d<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Why is this type of attack such a big deal? Because of the immense bandwidth amplification factor, or BAF, which is the potential effect of an amplification attack. A BAF can be calculated as the number of UDP payload bytes that an amplifier sends to answer a request, compared to the number of UDP payload bytes of the request.<\/p>\n\n\n\n<p>&#8220;15 bytes of request triggered 134KB of response. This is an amplification factor of 10,000x! In practice we&#8217;ve seen a 15-byte request result in a 750kB response (that&#8217;s a 51,200x amplification),&#8221; Cloudflare says.&nbsp;<a href=\"https:\/\/blog.cloudflare.com\/memcrashed-major-amplification-attacks-from-port-11211\/\">Memcrashed &#8211; Major amplification attacks from UDP port 11211<\/a><\/p>\n\n\n\n<p>Some other popularly known DDoS amplification attack vectors include poorly secured&nbsp;DNS&nbsp;resolution servers and network time protocol, or NTP. Looking at these and a few others below, you will see each listed with its corresponding BAF:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>DDoS Amplification Attack Vector<\/strong><\/td><td><strong>Bandwidth Amplification Factor<\/strong><\/td><\/tr><tr><td>DNS<\/td><td>50<\/td><\/tr><tr><td>NTP<\/td><td>58<\/td><\/tr><tr><td>Portmap (RPCbind)<\/td><td>28<\/td><\/tr><tr><td>LDAP<\/td><td>55<\/td><\/tr><tr><td>Memcached<\/td><td>51,000<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>These numbers make it incredibly easy to understand why Memcrashed is worrisome and potentially devastating for those that have not secured against it.<\/p>\n\n\n\n<p><a href=\"https:\/\/christian-rossow.de\/articles\/Amplification_DDoS.php\">Article<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.us-cert.gov\/ncas\/alerts\/TA14-017A\">Government Alert (TA14-017A)<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"memcrashed_%e2%80%9ckill-switch%e2%80%9d_and_data_theft_andor_corruption\"><\/span>Memcrashed &#8220;Kill-Switch&#8221; and Data Theft and\/or Corruption<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>While Corero Network Security, a DDoS &amp; Network Security Solutions provider, was investigating this issue, they discovered a &#8216;kill-switch&#8217; that they claim has been tested on live attack servers and has been 100% effective. The memcached &#8220;flush_all&#8221; command will invalidate the cache. If memcached is reloaded before the vulnerability patch is applied, then the &#8220;kill-switch&#8217; will be necessary again. The command should be sent to the originating attack servers, with a single &#8216;flush_all&#8217; command issued to each attacker.<\/p>\n\n\n\n<p>Unfortunately, while discovering the &#8216;kill-switch&#8217;, the team at Corero also found that this vulnerability is even worse than previously thought. This is mainly due to the way UDP and memcached functions.<\/p>\n\n\n\n<p>The Memcached protocol was designed to be used without logins or passwords, meaning that anything you add to a vulnerable Memcached server can be stolen by anyone on the internet, without a login, password or audit trail. By using a simple debug command, hackers can reveal the \u2018keys\u2019 to your data and retrieve the owner\u2019s data from the other side of the world. Additionally, it is also possible to maliciously modify the data and reinsert it into the cache without the knowledge of the Memcached owner.<\/p>\n\n\n\n<p>Despite repeated warnings by the Memcached developer community and large IT vendors about security risks, default configurations for some of the latest operating systems and cloud computing services still allow ubiquitous access to the Memcached service and customers\u2019 private data.<\/p>\n\n\n\n<p>There are several ways to flush Memcached. I prefer Telnet, so here is the sequence of commands you would use to accomplish this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  telnet memcached-server-ip PORT\n  flush_all\n  quit<\/code><\/pre>\n\n\n\n<p>Where: memcached-server-ip = Your server&#8217;s IP PORT = equals the memcached port, which is usually 11211<\/p>\n\n\n\n<p><strong>NOTE<\/strong>: Make sure you apply the patch and then restart Memcached:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  service memcached restart<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"what_can_i_do\"><\/span>What Can I Do?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Memcached developers have patched this&nbsp;<a href=\"https:\/\/github.com\/memcached\/memcached\/wiki\/ReleaseNotes156\">memcached patch notes<\/a>, but if you are running a version of Memcached older than version 1.5.6, you&nbsp;<em>must<\/em>&nbsp;either update or apply the required configuration changes yourself.<\/p>\n\n\n\n<p>If you are concerned about your Memcached installation, please don&#8217;t hesitate to open a ticket with Knownhost support so we can check the version and patch\/upgrade if necessary.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"how_can_i_secure_my_memcached_installation_by_editing_the_existing_configuration\"><\/span>How Can I Secure My Memcached Installation By Editing the Existing Configuration?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>For those of you that would rather do so yourself, here are instructions for recognizing the vulnerability and securing against it.<\/p>\n\n\n\n<p>First, check to see if your memcached is vulnerable. You can do by checking to see if the configurations either closes UDP or binds to localhost. Below, we first see an insecure instance of Memcached:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"72\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-1024x72.png\" alt=\"\" class=\"wp-image-772\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-1024x72.png 1024w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-300x21.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-768x54.png 768w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Since Memcached versions prior to 1.5.6 listen on INADDR_ANY and run with UDP support enabled by default, versions older than 1.5.6 are vulnerable. Version 1.5.6 secures this by completely disabling the UDP protocol for default installations.<\/p>\n\n\n\n<p>To secure older, vulnerable Memcached software, you can completely disable UDP if not in use or bind Memcached to a local interface only. Binding the IP to localhost can be done by modifying \/etc\/sysconfig\/memcached and adding &#8220;-l 127.0.0.1&#8221; to the &#8216;OPTIONS&#8217; list. You would specify &#8220;-U 0&#8221; to disable UDP.<\/p>\n\n\n\n<p>To secure Memcached by binding it to the localhost, you must edit its configuration file. The file reads as follows in default installations prior to version 1.5.6:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"900\" height=\"153\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-before.png\" alt=\"\" class=\"wp-image-773\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-before.png 900w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-before-300x51.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-before-768x131.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>Now compare the image below after I&#8217;ve bound Memcached to localhost:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"900\" height=\"199\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-after.png\" alt=\"\" class=\"wp-image-774\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-after.png 900w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-after-300x66.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/securing-memcached-after-768x170.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>Restart Memcached:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  service memcached restart<\/code><\/pre>\n\n\n\n<p>Check the process now:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"66\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/a-secured-memcached-process-1024x66.png\" alt=\"\" class=\"wp-image-775\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/a-secured-memcached-process-1024x66.png 1024w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/a-secured-memcached-process-300x19.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/a-secured-memcached-process-768x49.png 768w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/a-secured-memcached-process.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>We also need to make sure that port 11211 is closed in the firewall:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"57\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/good-memcached-port-not-open-in-fw-1024x57.png\" alt=\"\" class=\"wp-image-776\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/good-memcached-port-not-open-in-fw-1024x57.png 1024w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/good-memcached-port-not-open-in-fw-300x17.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/good-memcached-port-not-open-in-fw-768x43.png 768w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/good-memcached-port-not-open-in-fw.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>This shows that all incoming and outgoing UDP\/TCP ports are closed for port 11211.<\/p>\n\n\n\n<p>A&nbsp;<strong>better solution<\/strong>&nbsp;would be to disable UDP, and the best solution would be to disable UDP as well as bind to localhost. This is what I&#8217;ve done below:<\/p>\n\n\n\n<p>Here is the insecure memcached installation:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"900\" height=\"108\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-insecure-memcached-netstat.png\" alt=\"\" class=\"wp-image-777\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-insecure-memcached-netstat.png 900w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-insecure-memcached-netstat-300x36.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-insecure-memcached-netstat-768x92.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>The following shows where I&#8217;ve edited the file to set both options:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"900\" height=\"313\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/preferred_memcached_config.png\" alt=\"\" class=\"wp-image-778\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/preferred_memcached_config.png 900w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/preferred_memcached_config-300x104.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/preferred_memcached_config-768x267.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>After restarting memcached with the command &#8216;service memcached restart&#8217;, I can see that my Memcached installation is secured because it is only listening on localhost and UDP is disabled:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"900\" height=\"66\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-secured-memcached-netstat.png\" alt=\"\" class=\"wp-image-779\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-secured-memcached-netstat.png 900w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-secured-memcached-netstat-300x22.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/my-secured-memcached-netstat-768x56.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p>My running memcached process shows all options set that indicate that the daemon is secured:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"66\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/current-running-process-shows-as-secured-1024x66.png\" alt=\"\" class=\"wp-image-780\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/current-running-process-shows-as-secured-1024x66.png 1024w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/current-running-process-shows-as-secured-300x19.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/current-running-process-shows-as-secured-768x49.png 768w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/current-running-process-shows-as-secured.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>TCP is not currently considered a high-risk Memcached amplification vector because TCP queries are far less vulnerable to spoofing than UDP queries due the fact that you would also need to spoof TCP header fields relating to the state of the connection. Sending a spoofed TCP packet requires the attacker to guess the sequence number, which cannot be done reliably.<\/p>\n\n\n\n<p><a href=\"http:\/\/seclists.org\/basics\/2007\/Jul\/59\">Why TCP is more secure than UDP?<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"installing_and_securing_memcached_for_easyapache_4_centos_7cpanel_servers_everything_you_need_to_know\"><\/span>Installing and Securing Memcached for EasyApache 4 CentOS 7\/CPanel Servers: Everything You Need to Know<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>At the time of writing this article, installing memcached via yum installs an outdated version. I&#8217;ll show you how to install it, check the version, and if necessary, secure the installation here. We will also add it to cPanel&#8217;s Service Manager so that the service will be restarted upon reboot and we will also configure the firewall to ignore the false positive alerts that it will send about this foreign process that it does not recognize as legitimate (we know its legitimate because we installed it and configured it to be safe &nbsp;).<\/p>\n\n\n\n<p>First, log into your server via SSH as root (reminder: the default Knownhost SSH port is set to 2200):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  ssh root@&lt;IP&gt; -p2200<\/code><\/pre>\n\n\n\n<p>Now, install memcached:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  yum install memcached<\/code><\/pre>\n\n\n\n<p>Now, to check to see what version is installed by using telnet as shown in the screenshot below using the command &#8220;telnet localhost 11211&#8221;. Once connected, type &#8216;version&#8217; and press&nbsp;<em>Enter<\/em>, and the Memcached version will be returned. If the version is less than 1.5.6, then you will need to secure your memcached installation following the steps below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"800\" height=\"274\" src=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-insecure-version-installed-via-yum.png\" alt=\"\" class=\"wp-image-781\" srcset=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-insecure-version-installed-via-yum.png 800w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-insecure-version-installed-via-yum-300x103.png 300w, https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-insecure-version-installed-via-yum-768x263.png 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure>\n\n\n\n<p>Now, to secure the installation, use nano to edit the file \/etc\/sysconfig\/memcached:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  nano \/etc\/sysconfig\/memcached<\/code><\/pre>\n\n\n\n<p>You will change the following line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  OPTIONS=\"\"<\/code><\/pre>\n\n\n\n<p>To this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  OPTIONS=\"-l 127.0.0.1 -U 0\"<\/code><\/pre>\n\n\n\n<p>And then Ctrl X + y +Enter to exit and save the file.<\/p>\n\n\n\n<p>Now, start memcached.:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  service memcached start<\/code><\/pre>\n\n\n\n<p>Add memcached to the Service Manager so that it will be monitored and restarted as needed (following reboots, etc):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  chkconfig memcached on<\/code><\/pre>\n\n\n\n<p>Lastly, we need to make sure that the CSF\/LFD firewall that is installed by default with Knownhost servers is configured appropriately. Port 11211 should not be opened in the firewall by default, but it never hurts to check:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  grep 11211 \/etc\/csf\/csf.conf<\/code><\/pre>\n\n\n\n<p>If you get no output, then the port is not open. It only needs to be accessible locally, so the port should be closed.<\/p>\n\n\n\n<p>Next, we need to edit the firewall&#8217;s process ignore file so that the firewall won&#8217;t send us alerts about this newly added process. Open the process ignore file with nano:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  nano \/etc\/csf\/csf.pignore<\/code><\/pre>\n\n\n\n<p>Scroll to the bottom of the file and add either of these (use the executable option if you are likely to adjust the configuration of your installation, or be prepared to edit the cmd option in the firewall&#8217;s process ignore file when you do):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  exe:\/usr\/bin\/memcached\n  cmd:\/usr\/bin\/memcached -u memcached -p 11211 -m 64 -c 1024 -l 127.0.0.1 -U 0<\/code><\/pre>\n\n\n\n<p>Exit with Ctrl X + y + Enter and restart the firewall so that these changes take effect:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  csf -ra<\/code><\/pre>\n\n\n\n<p>That&#8217;s it! Enjoy your secured Memcached installation!&nbsp;<\/p>\n\n\n\n<p><strong>Note<\/strong>: If you also require the Memcache PHP extension, you can use the following command for EasyApache 4, however, you will need to replace ## with the PHP version that you intend to install it for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/opt\/cpanel\/ea-php##\/root\/usr\/bin\/pecl install memcache<\/code><\/pre>\n\n\n\n<p>Use the following command to confirm the installation (again, replacing ## with the PHP version required, e.g., 54, 55, 56, 70, 71, etc):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>  \/opt\/cpanel\/ea-php##\/root\/usr\/bin\/php -m | grep memcache<\/code><\/pre>\n\n\n\n<p>As always, if you have any questions or any trouble with this installation on your Knownhost server, please open a support request and we&#8217;ll be glad to help!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"cpanel_and_memcached\"><\/span>cPanel and Memcached<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Note that cPanel has memcached and memcache RPMs in their experimental EasyApache 4 repos at this time.&nbsp;<a href=\"https:\/\/features.cpanel.net\/topic\/memcached-in-easyapache4\">cPanel preview<\/a>. These are not yet secured via SASL authentication, but the statement in their Feature Request seems to indicate that they plan to use SASL to secure Memcached. You may want to watch for these to be moved into the stable repo so that you can replace your Memcached installation with a cPanel-supported installation when that time comes. Until then, make sure to either use a later version of Memcached, or to open a ticket with <a href=\"https:\/\/www.knownhost.com\/\">Knownhost<\/a> so that we can secure it for you.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Memcached Memcached is a memory object caching system for speeding up dynamic web applications\u2026 It&#8217;s open source and has been designed to work with a large number of open connections. Database calls,&nbsp;API&nbsp;calls, or page rendering are a few examples of the arbitrary data results that are stored in memory to alleviate database load. One can [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[92],"tags":[109,143,128,123,184,185,125],"class_list":["post-771","post","type-post","status-publish","format-standard","hentry","category-technical-support","tag-cpanel","tag-dedicated","tag-directadmin","tag-linux","tag-memcache","tag-memcached","tag-vps"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What is Memcrashed and how do I fix it? - KnownHost<\/title>\n<meta name=\"description\" content=\"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Memcrashed and how do I fix it? - KnownHost\" \/>\n<meta property=\"og:description\" content=\"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/\" \/>\n<meta property=\"og:site_name\" content=\"KnownHost\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-08T12:21:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-23T20:57:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"84\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jonathan K. W.\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jonathan K. W.\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/\"},\"author\":{\"name\":\"Jonathan K. W.\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\"},\"headline\":\"What is Memcrashed and how do I fix it?\",\"datePublished\":\"2021-07-08T12:21:02+00:00\",\"dateModified\":\"2026-01-23T20:57:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/\"},\"wordCount\":1875,\"image\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/memcached-process-1024x72.png\",\"keywords\":[\"cpanel\",\"dedicated\",\"directadmin\",\"linux\",\"memcache\",\"memcached\",\"vps\"],\"articleSection\":[\"Technical Support\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/\",\"url\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/\",\"name\":\"What is Memcrashed and how do I fix it? - KnownHost\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/memcached-process-1024x72.png\",\"datePublished\":\"2021-07-08T12:21:02+00:00\",\"dateModified\":\"2026-01-23T20:57:49+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\"},\"description\":\"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/memcached-process.png\",\"contentUrl\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/memcached-process.png\",\"width\":1200,\"height\":84},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/what-is-memcrashed-and-how-do-i-fix-it\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is Memcrashed and how do I fix it?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#website\",\"url\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/\",\"name\":\"KnownHost\",\"description\":\"KnownHost provides a comprehensive webhosting knowledge base to help answer many of your common webhosting and linux questions.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.knownhost.com\\\/kb\\\/#\\\/schema\\\/person\\\/3db6e20d1f33519cd68fe0ba1230a48b\",\"name\":\"Jonathan K. W.\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g\",\"caption\":\"Jonathan K. W.\"},\"sameAs\":[\"https:\\\/\\\/www.knownhost.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is Memcrashed and how do I fix it? - KnownHost","description":"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/","og_locale":"en_US","og_type":"article","og_title":"What is Memcrashed and how do I fix it? - KnownHost","og_description":"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.","og_url":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/","og_site_name":"KnownHost","article_published_time":"2021-07-08T12:21:02+00:00","article_modified_time":"2026-01-23T20:57:49+00:00","og_image":[{"width":1200,"height":84,"url":"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process.png","type":"image\/png"}],"author":"Jonathan K. W.","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jonathan K. W.","Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#article","isPartOf":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/"},"author":{"name":"Jonathan K. W.","@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b"},"headline":"What is Memcrashed and how do I fix it?","datePublished":"2021-07-08T12:21:02+00:00","dateModified":"2026-01-23T20:57:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/"},"wordCount":1875,"image":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#primaryimage"},"thumbnailUrl":"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-1024x72.png","keywords":["cpanel","dedicated","directadmin","linux","memcache","memcached","vps"],"articleSection":["Technical Support"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/","url":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/","name":"What is Memcrashed and how do I fix it? - KnownHost","isPartOf":{"@id":"https:\/\/www.knownhost.com\/kb\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#primaryimage"},"image":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#primaryimage"},"thumbnailUrl":"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process-1024x72.png","datePublished":"2021-07-08T12:21:02+00:00","dateModified":"2026-01-23T20:57:49+00:00","author":{"@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b"},"description":"In this guide we will explain what cpanel memcrashed is and how to fix memcrashed issue on your KnownHost server.","breadcrumb":{"@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#primaryimage","url":"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process.png","contentUrl":"https:\/\/www.knownhost.com\/kb\/wp-content\/uploads\/2021\/07\/memcached-process.png","width":1200,"height":84},{"@type":"BreadcrumbList","@id":"https:\/\/www.knownhost.com\/kb\/what-is-memcrashed-and-how-do-i-fix-it\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.knownhost.com\/kb\/"},{"@type":"ListItem","position":2,"name":"What is Memcrashed and how do I fix it?"}]},{"@type":"WebSite","@id":"https:\/\/www.knownhost.com\/kb\/#website","url":"https:\/\/www.knownhost.com\/kb\/","name":"KnownHost","description":"KnownHost provides a comprehensive webhosting knowledge base to help answer many of your common webhosting and linux questions.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.knownhost.com\/kb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.knownhost.com\/kb\/#\/schema\/person\/3db6e20d1f33519cd68fe0ba1230a48b","name":"Jonathan K. W.","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f432b99e6651fe8d1deb57a285bd84e806f1c9ae8b4c6c585d7e3a0b33789ad9?s=96&d=mm&r=g","caption":"Jonathan K. W."},"sameAs":["https:\/\/www.knownhost.com"]}]}},"_links":{"self":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts\/771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/comments?post=771"}],"version-history":[{"count":1,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts\/771\/revisions"}],"predecessor-version":[{"id":8056,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/posts\/771\/revisions\/8056"}],"wp:attachment":[{"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/media?parent=771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/categories?post=771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.knownhost.com\/kb\/wp-json\/wp\/v2\/tags?post=771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}