Do Son 
For roughly two weeks in August 2026, developers ran into a wave of PyPI file hosting errors that broke package installs. Users hit intermittent 502 and 503 responses when pip tried to pull files from files.pythonhosted.org. As a result, builds failed across countless projects that depend on the Python Package Index.
PyPI’s Mike Fiedler published a detailed incident report on the file hosting errors that explains what went wrong. The write-up traces two distinct problems, both now resolved. Downloads returned to full function on August 28.
What Users Experienced
Most people run pip install and it simply works. However, from mid-August onward, some requests started returning server errors instead of packages. The failures were intermittent, which made them hard to pin down.
Community reports proved essential here. Fiedler credits users directly, writing that thanks to “our users filing reports in the support tracker; one report in particular narrowed the problem to a single cache node.” That single clue helped isolate the root cause quickly.
Two Separate CDN Problems
Behind the scenes, files.pythonhosted.org runs on a Fastly CDN sitting in front of three origins. Consequently, a fault inside that delivery layer ripples out to every installer worldwide.
The first problem lived inside Fastly’s own network. According to the report, “A canary deployment inside Fastly’s network had triggered a misconfiguration at one cache node, causing Fastly’s routing layer to return 502 responses for traffic reaching the affected cache node.”
A partial rollback left the caching configuration on one Seattle point of presence reverted, while the routing layer in front of it was not. Therefore that mismatch produced steady 502s for any request routed through it.
Bugs Closer to Home
Meanwhile, the investigation surfaced older bugs in PyPI’s own Fastly configuration. As Fiedler puts it, he found and fixed “several bugs in our own Fastly configuration around origin fallback and range request behavior.”
One flaw broke the fallback from Backblaze B2 to Amazon S3. If B2 failed to answer at all, Fastly synthesized its own error and skipped the archive path entirely. Another bug returned a 501 status for suffix range requests, which some installers use to read wheel metadata without downloading a full file.
A third issue involved URL normalization. An exemption check ran before the URL was cleaned, so a bad response got cached and served to every later request for that file. Notably, none of these were new. They had been sitting in the configuration for a while.
Timeline of the PyPI File Hosting Errors
Fastly placed the start on August 15 at a single Seattle-area cache node. The first persistent 502 reports opened on August 17. By August 19, a user report isolated the fault to one node, cache-pae2080020, confirmed by x-served-by headers.
Fastly then removed the routing override and observed recovery on August 20. Over the following days, PyPI merged fixes for logging, range handling, and caching. Finally, on August 28, Fastly patched the canary bug and excluded all PSF traffic from its canary cohort.
Why It Matters for Security and Supply Chains
PyPI sits at the heart of the Python software supply chain. When file hosting breaks, automated pipelines stall and teams scramble for workarounds. Some of those workarounds can weaken security, so reliability here is a safety concern too.
Encouragingly, the fixes also cut background noise dramatically. Error traffic now sits two to three orders of magnitude below the pre-incident baseline. In other words, a long-hidden bug was quietly inflating failures the whole time.
Going Forward
The Python Software Foundation is hiring an infrastructure engineer to join its small engineering team. Part of that role will cover PyPI, which should help catch these conditions earlier. Fiedler notes that continued community donations make this work possible.
Developers can help too. Caching dependencies in CI, especially in GitHub Actions, means fewer requests hitting files.pythonhosted.org. Ultimately, that reduces load and gives your build one less thing that can break.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
