TLS is a protocol used to encrypt traffic, for example web browsing (HTTPS). To do this you need to do a handshake where you establish the encryption keys (which are used to encrypt the traffic). But there is nothing stopping someone sitting in the middle of this handshake from just doing the handshake with each part and then reading the traffic, which defeats the entire point of encryption. You need assurance that you are actually talking with who you want to be talking to.
This is where certificates come in. Certificates contain the domain name, the server's public key, and are signed by a certificate authority that vouches for the authenticity of the certificate. Your OS or browser has a store of CA certificates that are trusted. These certificates contain the public key of the CA. This public key is then used to check that the certificate the server presents is valid. To get a CA to sign a certificate you have to prove you have control over the domain name, this can be done in a few different ways and is usually automated.
The problem in the post is that someone has found the private key, which is used to do the signing, of one of the authorities. This means they could create a certificate for any domain name that they want to, and browsers/other software would accept as valid

ⓘ This user is suspected of being a cat. Please report any suspicious behavior.

I'll assume you know DNS resolution, which turns a URL like hexbear.net into an IP address. You try to go to hexbear dot net from your browser. But someone has set up a man-in-the-middle-attack. So when your browser tries to resolve the URL into an IP address, instead of the actual IP address you get a different one which could be hosting malware. TLS certificates help the browser (and other clients apart from browsers) make sure that the IP address is the authentic one.

Certificate Authorities have a process to confirm the real IP address of a domain name. Once they confirm it, they issue certificates which you can then serve to whoever is whoever is trying to visit your URL. If I am a malicious man-in-the-middle attacker, you can assume that I cannot get a certificate authority to give me certificates. This is because I don't own and control the domain name. You do.

Certificate authorities use cryptographic fuckery to sign certificates. They use their private keys to sign these certificates. Clients (like browsers) making web requests have their ways of knowing which legitimate certificate authorities exist and what their public keys are. So if a website serves you a certificate, your client will be able to verify that it is authentic.

But if the private signing key of a legitimate certificate authority is known, this security model falls apart. Because anyone can create a legitimate certificate. So if I am a man-in-the-middle attacker, I can serve forged certificates and your browser will never be able to tell because they look authentic to it.