It appears that SHA-1 is broken in practice. The website detailing this attack shows an infographic of how two PDF files can have the same SHA-1 hash value. Also Google's. I've also read Mathew's answer regarding the implications of this, and his explanation example focuses on PDFs.
What is it with PDFs? Does the attack only work on them exclusively? A PDF is just a sequence of bytes arranged in some order specified ages ago by Adobe Inc. I would have thought then that any two arbitrary file types could be attacked and hashed to the same value, not just PDFs.