I note this script takes two existing PDFs as an input and produces two new PDFs that collide with each other as output, but they do not collide with either of the originals. Thus this does not enable the obvious attack of creating a PDF that contains different text but collides with an existing PDF that you do not control. It does enable some other forms of duplicity, but only if you are the source of both documents.
It's been possible to create pairs of colliding PDF files. Taking any two existing PDFs and creating a colliding pair while keeping the same visible rendered output is probably what's new.
For MD5 we have what's called a chosen prefix collision. Given a start of a file, you can get back two "next bits" of the file which are similar but slightly different, and both those files (the chosen prefix plus A or chosen prefix plus B) have the same MD5.
Then because this is an MD family hash you can add any fixed suffix whatsoever to both and still get the same MD5.
So you put A and B inside a part of the file that isn't visible but can influence a conditional test elsewhere. Then you use the conditional test to flow the two different outputs, all the rest of the file is the same.
Some day this will definitely be possible with SHA1 and almost certainly (though it could be decades away) SHA256 too.
SHA3 is different, despite the name, we might perhaps never find any way to collide it, and if we do it's not MD it's a sponge design, so you can't just add a suffix or the output diverges again.
The fact that he produced something easy to see helps cement in the mind of more people exactly how possible it is. It's a benefit not in the sense that it was impossible before, but rather a benefit in the sense that more people will really believe that it is possible.
I didn't say it wasn't a benefit, I said there is no new innovation here. I was kind of wrong, but only insofar as it uses a different way to embed arbitrary garbage in a PDF instead of directly at the end. The concept is still the same (as it has to be).
Commit: https://github.com/corkami/pocs/commit/3832f62d8aad64d541c5d...
Readme: https://github.com/corkami/pocs/blob/master/collisions/READM... ("With this script, it takes less than a second to collide the 2 public PDF papers")