After a couple months of denial, RSA has finally come clean. SecureID is fatally compromised and will need replacement.
If you’re using SecureID tokens, they are no longer valid proof of “something you have” and cannot be relied upon as an authentication source. Switch to something else or shut down the service they are securing as soon as possible.