There's a new way to break RSA that's faster than anything we've seen before

Researchers demonstrated a forgery technique against blind-signature (textbook) RSA using a 'special' number field sieve and an oracle, reducing effective security levels (e.g., to ~2^65 for 1024-bit) and enabling signature forgeries with substantially fewer operations and core-years than full factoring; the attack could affect blind-signature deployments like Privacy Pass if an attacker can request ~2^43 tokens, though PKCS/PSS-padded RSA is not vulnerable and key rotation mitigates the threat.