They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.
So now we can't patch a security hole in a library without "recompiling" every application it's linked to? That seems like a huge step backwards to me.