“The vulnerability impacts the eXtended Keccak Code Package (XKCP), which is the "official" SHA-3 implementation by its designers.”
The official SHA-3 code from its own designers had a buffer overflow, and Python and PHP shipped it. Mouha shows it can forge collisions and run arbitrary code from a crafted file. Python is a memory-safe language right up to the C library it calls. The hash function was proven secure. The C wasn’t.