Not too long ago the first collision of the SHA-1 was found. If I get this right, that means that someone found two different inputs that give the same output. Two different messages give the same output. That this is even possible is trivial since the output always has a fixed length. From what I understand and hear, finding a collision is a major problem for a hashing algorithm and signals that the algorithm is more or less dead.
While I think I can see that there might be different types of collisions, my general questions are: How is finding a collision a problem? How can this be exploited?
It is not clear to me how just finding two random messages with the same hash will allow someone "easily" to for example sign messages or break hashed password files (ok so maybe storing hashed passwords isn't a good idea anyway). If I, for example (maybe oversimplified?), sign a message and you want to sign another message with the same hash, how would the knowledge of a specific collision help you?
EDIT: I see the question/answer here: What are the implications of a SHA-1 collision being found? but I don't think it answers my question. I understand that "It would be possible, in theory, for an attacker to generate two executable files which have the same SHA-1 hash, but perform different things when run." for example. But how likely is that? How does knowing a specific hash make tis possible? (I updated the title of the question).