Wang and colleagues published the first MD5 collisions in 2004; Stevens, Lenstra and de Weger made chosen-prefix collisions practical in 2007, and in 2008 a team used them to obtain a rogue intermediate CA certificate from a commercial CA that still signed with MD5. The Flame malware (2012) used an MD5 chosen-prefix collision to forge a Microsoft code-signing certificate. Collisions now take seconds on a laptop.
RFC 6151 (2011) says MD5 must not be used where collision resistance is required; RFC 9155 removed MD5 signatures from TLS 1.2. HMAC-MD5 and MD5 as a non-adversarial checksum (detecting accidental corruption, cache keys) are not broken in the same way, but there is no reason to choose MD5 for new designs when SHA-256 is often faster on modern CPUs (on one Apple M4 Max core, OpenSSL 3.6.5 hashes MD5 at about 0.86 GB/s and SHA-256 at 2.85 GB/s).