1. The SHAttered Collision Attack (2017)
In February 2017, researchers from CWI Amsterdam and Google announced the SHAttered attack, producing two distinct PDF documents with different visual contents that generated the exact same 160-bit SHA-1 hash. This proved that SHA-1 is vulnerable to collision forging in practice.
2. Deprecation Timeline
Major browsers (Chrome, Firefox, Safari) blocked SHA-1 SSL certificates in 2017. NIST officially mandated that SHA-1 must be phased out of all remaining federal operations by December 31, 2030.
3. Git Version Control and SHA-1
Git historically used 160-bit SHA-1 hashes as content-addressable IDs for objects and commits. Modern Git versions have implemented SHA-256 repository support (`git init --object-format=sha256`) to ensure future-proof cryptographic protection.