Forging 1024-bit RSA signatures in nearly SNFS time [pdf]

There's a new way to break RSA that's faster than anything we've seen before

I've factored the RSA keys of a Certificate Authority from the 90s

Factoring "short-sleeve" RSA keys with polynomials