The first public collision, SHAttered (Stevens and colleagues at CWI and Google, February 2017), produced two different PDF files with the same SHA-1 digest. In 2020 Leurent and Peyrin's "SHA-1 is a Shambles" made chosen-prefix collisions practical, costing tens of thousands of dollars of GPU time and allowing forged PGP key certifications. Preimage resistance is not broken.
Status: NIST disallowed SHA-1 for generating digital signatures in 2013 and announced in December 2022 that it will remove SHA-1 for applying protection in all applications by 31 December 2030. RFC 9155 deprecates MD5 and SHA-1 signatures in TLS 1.2; browsers stopped trusting SHA-1 certificates in 2017; OpenSSH 8.8 disabled the SHA-1 ssh-rsa signature algorithm by default.
Where it survives: Git object ids (with a collision-detecting implementation; SHA-256 repositories exist), OpenPGP v4 fingerprints, HMAC-SHA1 (not affected by collisions, still used in TOTP and some older protocols) and legacy certificates. Treat it as acceptable only where no attacker can influence the hashed data.