How to sign with RSA safely? what should I do to make my RSA signatures secure? If "plaintext RSA" is not secure, is there some sort of "RSA on steroids" I am not aware of? Could anybody tell me what is it?

I read a Wikipedia article "Digital signature". In the "History" chapter we can see:


  ...Soon afterwards, Ronald Rivest, Adi Shamir, and Len Adleman
  invented the RSA algorithm, which could be used to produce primitive
  digital signatures (although only as a proof-of-concept – "plain"
  RSA signatures are not secure


I searched for "rsa signature is not secure" but didn't find anything legible. Does anybody know why are RSA signatures are not secure and how can I make it secure by not doing "plain" signatures? Are there any tricks? The thing is that recently I implemented RSA in my code for my project and was so excited to see that I can sign and verify things with RSA...
The main modern standard RSA-based signature scheme is RSASSA-PSS in PKCS#1 v2, also standardized as IETF RFC 8017 (v2.2, obsoletes v2.1 in RFC 3447).  This is a variant of PSS proposed and analyzed by Bellare and Rogaway in 1996.

Beware: RSASSA-PSS as standardized by RSA, Inc., in the early 2000s, around the same time as Dual_EC_DRBG,* is vulnerable to collisions in the underlying hash function by virtue of using $H(r \mathbin\Vert H(m))$, instead of $H(r \mathbin\Vert m)$, which would have required of $H$ the much more modest security property (enhanced) target collision resistance.  This vulnerability to collisions led to a technique for practical HTTPS certificate forgery by academics, and to a different technique for certificate forgery used in an international incident of industrial sabotage by the United States and Israel against Iran.

If you need to get code running right now and for some reason you need to use RSA, that's the practical answer.  If you need to get code running right now but you don't actually need to use RSA, use Ed25519 instead—except for verification speed, it is an all-around faster, safer, and compacter signature scheme.

If you are studying existing code or an existing protocol that was not designed by a competent cryptographer, and you are wondering whether it uses a state-of-the-art signature scheme, you should expect it to use either RSASSA-PSS or PKCS#1 v1.5 signature.  If it doesn't, your eyebrows should be raised and whoever designed it has some justifyin' to do.

If you are intellectually absorbed by the wonders of the world of cryptography, or if like me you're a bone-eating vulture who likes blathering at strangers on the internet about things you've learned, then you should also know about full-domain hash, which was discarded essentially for political reasons among cryptographers but is easy to implement and instantiate with modern XOFs like SHAKE256, and Rabin–Williams signatures, which are more efficient with a tighter security reduction.  But make sure you know what you're trying to achieve before you go down that rabbit hole!



* I have no evidence to support a connection here, but coincidences like these are remarkably good at playing evidence in games of charades at parties.