https://news.ycombinator.com/item?id=38668893

(Also my work does not demonstrate any weakness in SHA256, it's just an application of the birthday paradox)

>We've just gotten 92% of the way to finding a single collision (this means that there is no full collision yet.). This has security ramifications in that other researchers are expected to be able to complete the work through similar methods as explored in the paper, and eventually produce collisions at will. We weren't sure if this was a remarkable result, since it's not a full collision, but we shared the work with the leading cryptographer in the field, who holds the world records in reduced-round attacks, and got great encouragement to proceed to publish it as a paper, so we did so.

(if we had found a single full collision, we would have just written "we broke SHA-256". This is 92% of the way to a full collision. Any collision is considered a great reduction in the security of the hash, because it means that there two different files with the same cryptographic hash. This is what happened to other algorithms such as MD5, as demonstrated in the linked tool.)

Before we continue, you can verify that we are able to make end-to-end collisions through our linked tool:

https://stateofutopia.com/experiments/md5collider

You can use literally any MD5 tool, including the ones built into Linux, Windows Powershell, any online MD5 calculator, etc, to test the differing files.

Our certificates implement the full SHA-256 algorithm and we provide the source code. You can verify it yourself using any and all means including writing your own version by hand if you don't trust our code. In addition to this, our results have been verified by other cryptographers. Thanks again for the question.

It's on the author to explain what they mean. Here, they haven't.