That's not entirely true. It's broken in the sense that for every hash given we can compute an input that produces this hash. Constructing a useful input (in this case a working exploit) is much less trivial. The complexity depends significantly on what the desired input should look like. It's easier for input that have the property that they can ignore chunks of the input (googles PDF example), but still hard for others.

We cannot produce an input that produces an arbitrary given hash. Here's an easy counterexample: the all-zeroes md5sum. That's an even harder problem than the one I've claimed is entirely not solved.

MD5 is still preimage and second-preimage resistant.