Heads up: a scam email impersonating LuminFire’s Tim Cimbura is circulating

If you’ve gotten an email recently that looks like it’s from Tim Cimbura, LuminFire’s CEO, warning that your website is running an outdated version of PHP and offering to fix it for $450 — please don’t reply or send any payment. It isn’t from us.

We’re actively tracking this one, and it’s already reached several of our clients as well as our own internal team.

This is part of a bigger trend

Outdated PHP is a real security concern — it’s one of the most common ways attackers get from “found a vulnerability” to full control of a website (what security folks sometimes call php2shell, since an exploitable PHP flaw can let an attacker drop a backdoor and run commands on your server). That real risk is exactly what scammers are counting on: a message about “urgent PHP security patching” sounds plausible enough that people don’t look too closely before reacting.

This is the kind of thing we expect to see more of, not less. As real security threats get more attention, scams that borrow that language and urgency to get a payment or a click are going to keep showing up in inboxes everywhere — not just ours.

How to tell it’s fake

A few details give this one away:

• It’s sent from a Gmail address ([email protected]), not a real @luminfire.com address.
• It has no links — just a request to reply, which is a common trick to slip past spam filters that look for suspicious URLs.
• It asks for payment before any real conversation about your site, your hosting, or what maintenance you already have in place.
• It uses Tim’s name and title, but none of our actual contact information, logos, or account details.
• It includes a fancy “Kind regards” closing in a font that LuminFire would not use.

Why it can’t actually come from us

You might wonder whether someone could truly send an email “as” luminfire.com. They can’t — our domain has DMARC and DKIM authentication configured, which means mail servers can verify that anything genuinely from @luminfire.com was actually sent by us. That’s exactly why this scam has to use a lookalike Gmail address instead of our real domain — it has no way to pass as luminfire.com mail.

If you’re not sure whether your own domain has DMARC and DKIM set up, it’s worth checking — these are quick to verify and relatively inexpensive to fix if they’re missing. We’re happy to help you sort that out.

If you’re already a LuminFire client

If your website is covered under one of our hosting plans, your PHP version and server security are already being monitored and kept current as part of that — this email doesn’t change anything about your coverage, and there’s nothing you need to do in response to it.

If you’d like us to double check anything, or just want a second set of eyes, reach out through Basecamp, the client portal, or our support form — whichever’s easiest for you.

The bigger picture

We’re not sharing this to scare anyone — phishing like this is increasingly common, and falling for one doesn’t mean you did anything wrong. It usually just means the message was well-crafted. If this is a wake-up call for your team, it might be worth looking at security awareness training, which helps people recognize the next one before it costs anything. It’s one of several services we offer around helping organizations stay ahead of this kind of threat through BrilliantSecurity— but regardless of whether you ever work with us on it, we wanted to make sure you had the heads up.

Stay safe out there, and when in doubt about any email claiming to be from us — ask us directly.