SHA-1 is a Shambles
The first chosen-prefix collision for SHA-1, from 2020 — the step from "theoretical worry" to "you can forge signatures with this".
Gaëtan Leurent and Thomas Peyrin published the result in January 2020 under a title that left little room for interpretation. The difference from SHAttered three years earlier matters: there, both files had to share the same beginning; here, the attacker picks two entirely different prefixes and then computes suffixes that make the hashes meet. That is the variant you need to forge a certificate or a signature. The computation ran for two months on 900 rented GPUs and cost around $45,000.
As a demonstration they built two PGP keys with different identities but the same SHA-1 signature, so that a certification of one also vouched for the other. GnuPG stopped trusting SHA-1-based identity signatures the same month.