Tencent App Security Flaw Opens Door to GrayRabbit Malware Attacks

Cybersecurity researchers have uncovered a concerning attack campaign in which hackers exploited a vulnerability in a Tencent application to deliver GrayRabbit malware to targeted systems. The incident highlights how weaknesses in trusted software can become an entry point for attackers and why users should treat application updates and endpoint security as essential parts of digital safety.

A New Malware Delivery Route

Modern cyberattacks rarely depend on a single technique. Attackers often combine software vulnerabilities, social engineering, malicious files and persistence mechanisms to move from an initial compromise toward a larger infection.

In the campaign involving GrayRabbit, attackers reportedly took advantage of a flaw associated with Tencent software. Rather than relying solely on users downloading an obviously malicious program, the attackers used a legitimate application as part of the infection chain.

This approach can make an attack more difficult to recognize. Security software and users may naturally place greater trust in applications associated with well-known technology companies.

What Is GrayRabbit?

GrayRabbit is a malware threat associated with attacks designed to gain unauthorized access to compromised computers. Like other modern malware families, its capabilities can vary depending on the version deployed and the infrastructure controlled by the attackers.

Malware of this type can potentially be used to establish persistence, collect information, download additional malicious components or provide attackers with further control over an infected machine.

The most important concern is therefore not necessarily the initial malware file itself. Once attackers obtain a foothold, they may attempt to expand their access and introduce additional tools.

How the Attack Works

The reported campaign demonstrates a familiar pattern in modern cybercrime.

1. Exploiting vulnerable software

The attack begins with a weakness in the targeted Tencent application. A vulnerability can provide attackers with an opportunity to execute unauthorized actions or manipulate the software's normal behavior.

Software vulnerabilities become particularly dangerous when affected applications are widely installed.

2. Delivering the malicious payload

After gaining an initial foothold, attackers can attempt to introduce GrayRabbit or another malicious component onto the victim's system.

The malware may be disguised within a broader infection process, making it less obvious than a conventional malicious executable.

3. Establishing persistence

Attackers commonly attempt to ensure that malware survives a system restart. Persistence allows criminals to maintain access without having to repeat the original intrusion.

4. Communicating with attacker infrastructure

Once installed, malware may communicate with remote infrastructure controlled by the attackers. Depending on its configuration, this communication can allow criminals to issue commands or exchange information.

5. Expanding the compromise

A successful initial infection can become the starting point for additional malicious activity. Attackers may attempt to steal credentials, gather system information or deploy other malware.

Why a Trusted Application Can Become a Security Risk

One of the most important lessons from this incident is that trusted software is not automatically risk-free.

Popular applications are attractive targets because they can be installed on millions of computers. A vulnerability in widely deployed software can potentially give attackers access to a much larger pool of victims.

This is one reason security professionals recommend maintaining an updated software environment rather than assuming that well-known applications are inherently safe.

The Importance of Software Updates

Security patches are one of the simplest ways to reduce exposure to known vulnerabilities.

When developers discover a security weakness, they may release an updated version that addresses the underlying problem. Users who continue running older versions can remain vulnerable even after a fix becomes available.

Individuals and organizations should therefore:

• Keep operating systems updated.
• Install security updates for applications promptly.
• Remove outdated software that is no longer required.
• Download applications from legitimate sources.
• Avoid modified or unofficial software packages.
• Use reputable endpoint-security tools.
• Monitor unusual application behavior.

Organizations Face Greater Risks

The consequences can be considerably more serious in corporate environments.

A compromised employee workstation may contain credentials, documents, browser sessions and access to internal services. If attackers successfully move from one machine to another, a small software vulnerability can potentially develop into a larger security incident.

Businesses should combine patch management with endpoint detection, network monitoring, access controls and employee security awareness.

The principle of least privilege is particularly useful. Applications and users should receive only the permissions they genuinely need. If malware manages to compromise one account, limiting its privileges can reduce the damage.

Signs of a Possible Infection

No single symptom proves that GrayRabbit or another specific malware family is present. However, unusual system behavior should receive attention.

Potential warning signs include:

• Unexpected applications appearing on a computer.
• Unknown processes consuming significant resources.
• Unexplained network connections.
• Browser settings changing without permission.
• Security software being disabled unexpectedly.
• New startup entries appearing.
• Unusual account activity.
• Unexpected files or scripts being created.

Organizations should investigate suspicious behavior through their security-monitoring systems rather than relying only on visual symptoms.

What Users Should Do

If a computer may have been compromised, users should avoid experimenting with suspicious files or attempting to manually remove unknown system components without understanding their purpose.

A safer response is to:

1. Disconnect the affected computer from unnecessary networks.
2. Run a reputable security scan.
3. Update the operating system and affected applications.
4. Change important passwords from a known-clean device.
5. Enable multi-factor authentication where possible.
6. Review account activity for suspicious logins.
7. Contact an organization's IT or security team if the computer is business-owned.

Organizations should preserve relevant logs and forensic information before wiping compromised systems when an investigation may be necessary.

A Broader Warning for the Software Industry

The GrayRabbit incident illustrates a broader reality of cybersecurity: attackers increasingly look for weaknesses in the software users already trust.

The security of an application is not determined only by its developer. Users, administrators, operating-system vendors and security teams all play a role in reducing the attack surface.

Software companies must continue investing in vulnerability research, secure development practices and rapid patch distribution. At the same time, users need to install those fixes instead of leaving vulnerable versions on their devices.

Conclusion

The reported exploitation of a Tencent application vulnerability to distribute GrayRabbit malware is another reminder that cybercriminals can turn weaknesses in legitimate software into powerful attack opportunities.

For users, the most practical defenses remain straightforward: keep software patched, avoid unofficial downloads, use strong authentication and pay attention to unusual system activity.

For organizations, the incident reinforces the importance of vulnerability management, endpoint monitoring and limiting user privileges.

As attackers become more sophisticated, cybersecurity is increasingly about reducing opportunities for compromise before a malicious program gets the chance to establish itself.

 

Organize Your Files Automatically with Python

A messy downloads folder can become surprisingly difficult to manage. Images, PDFs, documents, videos, ZIP files, spreadsheets, and installers often end up sitting together with meaningless filenames. Finding one particular file later can take more time than actually downloading it.

Fortunately, you don't need an expensive file-management application to solve the problem. With Python, you can build a small automation script that examines files, identifies their types, and moves them into appropriate folders automatically.

This is a practical Python project for beginners because it introduces useful concepts such as directories, file extensions, loops, conditions, functions, and error handling.

Why Automate File Organization?

Manually sorting files works when there are only a few files. But when dozens of files arrive every week, repetitive organization becomes tedious.

A Python script can handle the repetitive part for you.

For example, it could transform this:

Downloads/
├── report.pdf
├── holiday.jpg
├── presentation.pptx
├── movie.mp4
├── music.mp3
├── archive.zip
└── notes.txt

Into:

Downloads/
├── Documents/
│   ├── report.pdf
│   ├── presentation.pptx
│   └── notes.txt
├── Images/
│   └── holiday.jpg
├── Videos/
│   └── movie.mp4
├── Music/
│   └── music.mp3
└── Archives/
    └── archive.zip

Once configured, the process can happen automatically.

Python Libraries You Need

The good news is that you don't need a large collection of external packages.

Python's built-in pathlib module is enough for a basic organizer.

pathlib provides a convenient way to work with files and directories while keeping the code readable.

You can start with:

from pathlib import Path
import shutil

Here, Path handles filesystem paths, while shutil provides the file-moving operation.

Choosing the Folder

Suppose you want to organize your Downloads directory.

You can create a path like this:

from pathlib import Path

downloads = Path.home() / "Downloads"

print(downloads)

Using Path.home() is preferable to hard-coding a username because it makes the script easier to reuse on different computers.

You can also select another directory:

folder = Path("/path/to/your/folder")

The exact path format depends on your operating system.

Defining File Categories

Next, tell Python which extensions belong to each category.

categories = {
    "Images": [".jpg", ".jpeg", ".png", ".gif", ".webp"],
    "Documents": [".pdf", ".docx", ".txt", ".odt"],
    "Spreadsheets": [".xlsx", ".xls", ".csv"],
    "Videos": [".mp4", ".mkv", ".avi", ".mov"],
    "Music": [".mp3", ".wav", ".flac"],
    "Archives": [".zip", ".rar", ".7z", ".tar", ".gz"]
}

This dictionary acts as the organizer's rulebook.

When Python encounters a .jpg file, it knows that the file belongs in Images.

When it finds a .pdf, it knows that the destination should be Documents.

Creating Destination Folders

Before moving anything, the program should make sure the destination folders exist.

for category in categories:
    destination = folder / category
    destination.mkdir(exist_ok=True)

The exist_ok=True option prevents Python from raising an error when the directory already exists.

This makes the script safe to run repeatedly.

Finding Files

Now we can examine the contents of the selected folder.

for file in folder.iterdir():
    print(file)

However, this may include directories as well as files.

We can restrict the operation to files:

for file in folder.iterdir():
    if file.is_file():
        print(file.name)

The program can now inspect every file individually.

Checking File Extensions

Every Path object has a .suffix property.

For example:

file.suffix

could return:

.pdf

We can convert it to lowercase:

extension = file.suffix.lower()

This is useful because .JPG and .jpg should normally be treated as the same type.

Moving the Files

Now we can combine everything.

from pathlib import Path
import shutil

folder = Path.home() / "Downloads"

categories = {
    "Images": [".jpg", ".jpeg", ".png", ".gif", ".webp"],
    "Documents": [".pdf", ".docx", ".txt", ".odt"],
    "Spreadsheets": [".xlsx", ".xls", ".csv"],
    "Videos": [".mp4", ".mkv", ".avi", ".mov"],
    "Music": [".mp3", ".wav", ".flac"],
    "Archives": [".zip", ".rar", ".7z", ".tar", ".gz"]
}

for category in categories:
    (folder / category).mkdir(exist_ok=True)

for file in folder.iterdir():

    if not file.is_file():
        continue

    extension = file.suffix.lower()

    for category, extensions in categories.items():

        if extension in extensions:
            destination = folder / category / file.name
            shutil.move(str(file), str(destination))

            print(f"Moved: {file.name} → {category}")
            break

That's the core of the automated organizer.

What Happens When You Run It?

The script scans the folder one file at a time.

For each file, it:

1. Checks whether it is actually a file.
2. Reads its extension.
3. Compares the extension against your categories.
4. Creates the appropriate destination path.
5. Moves the file.
6. Prints what happened.

For example:

Moved: vacation.jpg → Images
Moved: invoice.pdf → Documents
Moved: backup.zip → Archives
Moved: song.mp3 → Music

You can immediately see which files were processed.

What About Unknown File Types?

Not every file will match your categories.

Perhaps your folder contains:

setup.exe
database.db
model.pt
script.py

You have several options.

One approach is to create an Others folder.

others = folder / "Others"
others.mkdir(exist_ok=True)

Files that don't match any known extension can then be moved there.

Alternatively, you can leave unknown files untouched. This is often safer because you won't accidentally move something important simply because its extension wasn't recognized.

Handling Duplicate Filenames

One problem appears when a destination already contains a file with the same name.

For example:

Images/photo.jpg

already exists and the Downloads folder contains another:

photo.jpg

A robust organizer shouldn't blindly overwrite files.

You can generate a new filename when a conflict occurs:

def unique_path(path):
    if not path.exists():
        return path

    counter = 1

    while True:
        new_path = path.with_name(
            f"{path.stem}_{counter}{path.suffix}"
        )

        if not new_path.exists():
            return new_path

        counter += 1

Then use:

destination = unique_path(folder / category / file.name)

This could turn:

photo.jpg

into:

photo_1.jpg

instead of replacing the existing file.

Making the Script Safer

Automation involving your filesystem deserves caution.

Before running the organizer on an important directory, test it using a temporary folder containing copies of your files.

You can also begin by printing what the script would move:

print(f"Would move {file.name} to {category}")

Only after confirming the results should you replace the print statement with the actual move operation.

Another useful improvement is to maintain a log of every operation.

For example:

2026-09-08 | report.pdf | Documents
2026-09-08 | image.png | Images

A log makes it easier to understand what the automation has done.

Organizing More Than Downloads

Once you understand the basic technique, you can adapt it to other folders.

For example, you could organize:

• Screenshots
• School projects
• Work documents
• Camera images
• E-books
• Programming projects
• Backup files
• Research materials

You can also create more specialized categories.

For example:

categories = {
    "Python": [".py"],
    "Web": [".html", ".css", ".js"],
    "PDF": [".pdf"],
    "Images": [".png", ".jpg", ".jpeg"],
}

This turns the same basic script into a project-specific organizer.

Taking Automation Further

The next step is to make the program run automatically.

On Windows, you can use Task Scheduler. On Linux and macOS, scheduled execution can be handled using tools such as cron or launch services.

You could also create a program that continuously watches a directory and organizes new files as they arrive.

That changes the project from a one-time script into a background automation tool.

For example:

New file appears → Python detects it → Extension is identified → Category is selected → File is moved

You could even add rules based on filename, creation date, file size, or other properties.

Final Thoughts

Automatically organizing files is a small Python project with surprisingly practical value. It demonstrates how programming can eliminate repetitive computer tasks that people normally perform manually.

The basic concept is simple: inspect files, identify their characteristics, choose a destination, and move them according to predefined rules.

Once you understand pathlib, dictionaries, loops, conditions, and shutil, you have everything needed to build a useful first version.

From there, you can add duplicate protection, logging, custom rules, scheduled execution, and real-time folder monitoring.

What begins as a simple Downloads-folder cleaner can ultimately become a flexible personal file-management system powered entirely by Python.

 

The Local AI Stack: Building Productive SLMs on Your Own Machine

Artificial intelligence is often associated with enormous cloud-based models, expensive GPUs, and constant internet connectivity. But a quieter shift is happening: small language models (SLMs) are becoming practical enough to run locally.

Instead of sending every prompt, document, or piece of code to a remote server, developers can increasingly build AI applications that operate directly on a laptop, desktop, workstation, or edge device.

This is where the local AI stack becomes important.

A productive local SLM setup is not simply about downloading a model and asking it questions. The real advantage comes from combining a model with an inference engine, model format, retrieval system, local data, development tools, and an application layer.

The result can be a private, responsive, and surprisingly capable AI environment.

What Is a Local AI Stack?

A local AI stack is the collection of software and hardware components required to run AI models on your own infrastructure.

A typical architecture looks like this:

Hardware → Runtime → Model → Context/RAG → Tools → Application

Each layer has a different responsibility.

• Hardware provides CPU, GPU, RAM, and storage.
• Runtime executes the model efficiently.
• Model generates text, code, summaries, classifications, or structured output.
• Context layer supplies information from local documents and databases.
• Tools allow the model to interact with applications and data.
• Application layer turns all of these components into something useful.

This modular design makes local AI much more interesting than simply running a chatbot offline.

Why Use Small Language Models?

Large language models remain extremely powerful, but they are not always necessary.

Many everyday tasks have relatively narrow requirements:

• Summarizing documents
• Extracting information
• Classifying text
• Generating SQL
• Writing small pieces of code
• Searching personal notes
• Processing customer messages
• Creating structured JSON
• Rewriting content
• Answering questions about local documents

For these workloads, a carefully selected SLM can be fast and inexpensive.

The biggest advantage is often latency.

A locally running model doesn't need to send a request across the internet and wait for a remote server to process it. If the model fits comfortably within your hardware's capabilities, responses can feel almost immediate.

The Hardware Layer

The first component of a local AI stack is the machine itself.

You don't necessarily need a high-end AI workstation.

A modern computer with sufficient RAM can run quantized SLMs, while a dedicated GPU can dramatically improve performance.

CPU

CPUs are perfectly usable for smaller models.

They are particularly suitable for:

• Lightweight assistants
• Text classification
• Document processing
• Automation
• Background AI tasks

The downside is that token generation can become slow with larger models.

GPU

A GPU can significantly accelerate inference because language-model calculations are highly parallel.

If you have a compatible NVIDIA, AMD, or Apple GPU, local inference can become considerably faster.

RAM and VRAM

Memory is one of the most important considerations.

A model doesn't only need space for its weights. The system also requires memory for the context window, runtime, temporary calculations, and other processes.

This is why a model advertised as "4 GB" doesn't necessarily mean your computer needs exactly 4 GB of free memory.

Quantization Makes Local AI Practical

One of the most important technologies behind local SLMs is quantization.

Traditional neural-network weights can use relatively high numerical precision. Quantization reduces that precision to represent the model using fewer bits.

Instead of storing weights using larger numerical formats, a quantized model might use 8-bit, 6-bit, 5-bit, or 4-bit representations.

The result is generally:

Smaller model + lower memory requirements + faster inference

There can be some loss in quality, but modern quantization techniques can preserve surprisingly strong performance.

For local experimentation, formats such as GGUF have become particularly useful because they work well with popular CPU and GPU inference ecosystems.

The Inference Runtime

After choosing a model, you need software capable of running it.

Several local inference runtimes have become popular among developers.

llama.cpp

llama.cpp is one of the most influential projects in local LLM inference.

Its major strength is portability. It allows models to run across different hardware environments and has helped make quantized local models accessible to ordinary computers.

It is particularly useful when you want direct control over inference.

Ollama

Ollama focuses on making local model deployment easier.

Instead of manually managing every component, developers can use a relatively simple command-line workflow to download and run supported models.

It is particularly attractive for developers who want to quickly experiment with local AI or connect models to applications through an API.

LM Studio

For people who prefer a graphical interface, LM Studio provides a convenient way to discover and run local models.

It can be useful for testing different models before integrating one into a larger application.

The important point is that these tools are not the AI model itself.

They are execution environments.

Choosing the Right SLM

The smallest model isn't automatically the best model.

Instead, select a model based on the task.

For example:

Task	Useful SLM Characteristics
Coding	Strong code-generation ability
Summarization	Good instruction following
Document Q&A	Strong context handling
Classification	Fast and lightweight
SQL generation	Strong reasoning and SQL knowledge
Local assistant	Balanced general-purpose performance
Extraction	Reliable structured output

A 3B or 4B model can be excellent for lightweight automation, while a 7B–14B model may provide stronger reasoning when the hardware can handle it.

The best local model is therefore determined by workload, hardware, latency, and accuracy requirements.

Local RAG: Giving the SLM Your Knowledge

A model's built-in knowledge isn't enough for many practical applications.

Suppose you have thousands of PDFs, technical documents, notes, or company files.

Rather than retraining the model, you can build a Retrieval-Augmented Generation (RAG) system.

The basic workflow is:

Documents → Chunking → Embeddings → Vector Database → Retrieval → SLM

When the user asks a question, the application searches the local knowledge base and provides relevant passages to the model.

The SLM then generates an answer using that retrieved context.

This is powerful because the model itself doesn't need to memorize everything.

Embeddings and Vector Search

A local AI stack often includes an embedding model.

An embedding model converts text into numerical vectors that capture semantic relationships.

For example, these two sentences:

"How can I reduce my electricity bill?"

and

"Ways to lower household power consumption"

use different words but have similar meanings.

A vector search system can recognize this relationship.

Tools such as FAISS, Chroma, Qdrant, and SQLite-based vector approaches can be used depending on the complexity of the application.

For smaller personal projects, even a lightweight local database can be enough.

Local AI and Privacy

Privacy is one of the strongest arguments for local AI.

Imagine an application that processes:

• Personal documents
• Internal company files
• Source code
• Financial spreadsheets
• Private notes
• Sensitive research
• Customer information

Sending everything to an external API may not always be desirable.

With local inference, data can remain inside your environment.

However, "local" does not automatically mean "secure."

You still need to protect:

• Stored documents
• Model files
• Databases
• API endpoints
• Authentication credentials
• Logs
• Application access

Local AI reduces dependence on external services, but security remains an engineering responsibility.

Connecting SLMs to Tools

A productive AI system should do more than generate text.

It should be able to interact with tools.

For example, an SLM could receive a request:

"Find this month's sales figures and create a summary."

The model could determine that it needs to:

1. Query a local database.
2. Retrieve the relevant records.
3. Calculate totals.
4. Generate a summary.
5. Return structured results.

This is where tool calling and agent-style workflows become useful.

The SLM acts as the reasoning component while traditional software performs deterministic operations.

That distinction is important.

AI should not be responsible for calculations when a database or Python function can perform them reliably.

Python as the Glue

Python is particularly useful for connecting the pieces.

A local AI application can combine:

• Python
• An SLM runtime
• Embedding models
• Vector databases
• SQLite
• APIs
• File processing
• Web interfaces
• Automation scripts

For example:

User
  ↓
Python Application
  ↓
Retriever ──→ Local Documents
  ↓
SLM Runtime
  ↓
Small Language Model
  ↓
Tool / Database / File System
  ↓
Response

This architecture makes it possible to create surprisingly capable assistants without building a huge AI infrastructure.

Local AI for Developers

Developers can use local SLMs for more than chatting.

A coding assistant could:

• Explain unfamiliar functions
• Generate boilerplate
• Write tests
• Convert code between languages
• Review small code snippets
• Generate SQL
• Search local documentation
• Summarize Git commits
• Help debug errors

The major advantage is that proprietary source code can potentially remain inside the development environment.

For organizations with strict data policies, this can be particularly valuable.

Local AI for Document Work

Document processing is another strong use case.

Consider a folder containing hundreds of PDFs.

A local pipeline could automatically:

1. Detect new files.
2. Extract their text.
3. Split the text into chunks.
4. Generate embeddings.
5. Store vectors locally.
6. Retrieve relevant passages.
7. Ask the SLM to summarize them.
8. Save the results.

This transforms a basic language model into a personal document intelligence system.

The Role of Small Models in Agentic AI

The rise of AI agents doesn't necessarily mean every agent needs a giant model.

Many agent tasks are repetitive and constrained.

A smaller model may be perfectly capable of deciding:

• Which tool should I call?
• Which file should I inspect?
• Which database query should I execute?
• Should I summarize this result?
• What format should the output use?

For highly complex reasoning, a larger model may still be preferable.

But for controlled workflows, SLMs can offer a compelling balance between cost, speed, privacy, and capability.

A Practical Local Stack

A modern developer might build a stack like this:

Hardware

A laptop or desktop with adequate RAM and optional GPU acceleration.

Model runtime

Ollama or llama.cpp.

SLM

A compact instruction-tuned model appropriate for the workload.

Embeddings

A lightweight local embedding model.

Storage

SQLite for structured information and a vector database for semantic retrieval.

Programming

Python.

Interface

A command-line application, web dashboard, desktop interface, or API.

Automation

Scheduled scripts or event-driven workflows.

This stack can be built incrementally rather than all at once.

Start Small

One mistake is trying to build a complete AI agent platform immediately.

Instead, begin with a simple experiment.

Run a small model locally.

Then expose it through an API.

Next, connect a Python script.

After that, add document retrieval.

Then add tools.

Finally, create an interface.

This progression makes debugging much easier because each layer can be tested independently.

Local AI Isn't About Replacing Cloud AI

The future probably won't be a simple choice between local and cloud AI.

A hybrid approach is often more practical.

For example:

Local SLM → routine tasks

Cloud LLM → difficult reasoning

Local RAG → private information

Cloud services → specialized capabilities

An application could automatically route different requests to different models.

Simple requests stay local, while complicated workloads are sent to a more powerful remote model when appropriate.

The Bigger Picture

The most interesting development in local AI isn't simply that models are getting smaller.

It's that the entire ecosystem around them is becoming easier to use.

Models are becoming more efficient.

Quantization is reducing memory requirements.

Inference runtimes are becoming faster.

Embedding systems are becoming easier to deploy.

Vector databases are becoming accessible.

Tool calling is connecting models to ordinary software.

Together, these technologies turn an SLM from an isolated chatbot into a local computing component.

That is the real promise of the local AI stack.

Conclusion

Small language models are changing the way developers think about AI deployment.

You no longer need a massive cloud infrastructure for every intelligent application. A capable computer, a quantized SLM, an efficient runtime, local retrieval, and a little Python can provide the foundation for useful AI systems.

The key isn't choosing the biggest model.

It is designing the right stack for the job.

A productive local AI environment should be fast enough for your workload, small enough for your hardware, private enough for your data, and flexible enough to connect with the software you already use.

As SLMs continue improving, local AI could become less of a specialized experiment and more of a normal part of everyday computing.

 

Build Real-Time Communication with Python and WebSockets

Modern applications are expected to respond instantly. Whether it is a chat application, live notification system, multiplayer game, collaborative editor, or monitoring dashboard, users increasingly expect information to appear without repeatedly refreshing a webpage.

One technology that makes this possible is WebSockets.

Combined with Python, WebSockets provide a straightforward way to create applications where the client and server can communicate continuously. Instead of opening a new HTTP connection for every request, a WebSocket connection stays open and allows both sides to exchange messages whenever needed.

This article explains how to build a simple real-time communication system with Python and WebSockets, how it works, and how you can extend it into a more practical application.

What Are WebSockets?

Traditional HTTP communication usually follows a request-response pattern.

The browser sends a request:

Client → Server

The server processes it and sends a response:

Server → Client

The connection is generally finished after the response.

This approach works extremely well for websites and APIs, but it becomes inefficient when information needs to be delivered continuously.

Imagine a chat application. If someone sends you a message, the browser needs to discover that message somehow. One approach is polling—asking the server every few seconds whether anything has changed.

WebSockets solve this differently.

Once a WebSocket connection has been established, it can remain open:

Client ↔ Server

Either side can send information when necessary.

That makes WebSockets particularly useful for real-time communication.

Why Use Python?

Python has a large ecosystem for building web applications and network services. Developers can choose from several frameworks and libraries depending on their requirements.

For a simple demonstration, FastAPI combined with its WebSocket support provides a clean approach.

You can install the required packages with:

pip install fastapi uvicorn

FastAPI provides the application framework, while Uvicorn can run the application as an ASGI server.

Creating a WebSocket Server

Let's start with a minimal server.

Create a file called main.py:

from fastapi import FastAPI, WebSocket

app = FastAPI()

@app.websocket("/ws")
async def websocket_endpoint(websocket: WebSocket):
    await websocket.accept()

    while True:
        message = await websocket.receive_text()
        await websocket.send_text(f"Server received: {message}")

This small program does several things.

First, it creates a FastAPI application.

The /ws endpoint is configured as a WebSocket endpoint rather than a normal HTTP route.

When a client connects, the server accepts the WebSocket connection:

await websocket.accept()

The server then waits for messages:

message = await websocket.receive_text()

After receiving one, it sends a response:

await websocket.send_text(...)

The while loop keeps the communication alive.

Running the Server

Start the application with:

uvicorn main:app --reload

The server will normally become available locally through port 8000.

Your WebSocket endpoint will be:

ws://localhost:8000/ws

Notice that WebSockets use ws:// rather than the familiar http://.

For encrypted connections, you would use wss://.

Connecting from a Browser

You can create a simple HTML page to communicate with the Python server.

<!DOCTYPE html>
<html>
<head>
    <title>WebSocket Demo</title>
</head>
<body>

<input id="message" placeholder="Enter message">
<button onclick="sendMessage()">Send</button>

<div id="output"></div>

<script>
    const socket = new WebSocket("ws://localhost:8000/ws");

    socket.onopen = () => {
        console.log("Connected to server");
    };

    socket.onmessage = (event) => {
        document.getElementById("output").innerHTML +=
            `<p>${event.data}</p>`;
    };

    function sendMessage() {
        const input = document.getElementById("message");
        socket.send(input.value);
        input.value = "";
    }
</script>

</body>
</html>

When the page connects, the browser establishes a WebSocket connection with the Python server.

When you click Send, the browser transmits the message.

The Python server receives it and sends a response back.

The browser receives that response through:

socket.onmessage

No page refresh is required.

Turning It Into a Chat Server

A more useful example is a basic chat room.

The server needs to keep track of connected clients.

One simple implementation looks like this:

from fastapi import FastAPI, WebSocket, WebSocketDisconnect

app = FastAPI()

connections = []

@app.websocket("/chat")
async def chat(websocket: WebSocket):
    await websocket.accept()
    connections.append(websocket)

    try:
        while True:
            message = await websocket.receive_text()

            for connection in connections:
                await connection.send_text(message)

    except WebSocketDisconnect:
        connections.remove(websocket)

Now, whenever one client sends a message, the server broadcasts it to the connected clients.

This is the basic architecture behind many real-time applications.

However, this example is intentionally simple. A production system needs additional handling for authentication, connection failures, multiple server instances, message persistence, and security.

Adding Usernames

Instead of sending plain messages, you can send structured data.

JSON is a common choice.

For example:

{
    "username": "Alex",
    "message": "Hello everyone!"
}

Python can receive JSON using:

data = await websocket.receive_json()

You can then broadcast information such as:

await connection.send_json({
    "username": data["username"],
    "message": data["message"]
})

This makes it easier for the frontend to display usernames, timestamps, message types, and other metadata.

Handling Disconnections

Real-time applications must assume that users can disappear unexpectedly.

A phone may lose its internet connection. A browser tab may close. A laptop may enter sleep mode.

FastAPI provides WebSocketDisconnect for handling this situation.

try:
    while True:
        message = await websocket.receive_text()
except WebSocketDisconnect:
    print("Client disconnected")

Proper cleanup prevents disconnected connections from remaining in your server's connection list.

WebSockets Beyond Chat

Chat is only one application.

The same technology can power many other systems.

Live Notifications

An application can immediately notify users when something happens.

For example:

• New order received
• Payment completed
• New comment posted
• Task assigned
• Server alert triggered

Real-Time Dashboards

A monitoring application can continuously send updated information to a browser.

Instead of refreshing the dashboard every few seconds, the server pushes new values as they become available.

Multiplayer Games

Game clients can exchange state information with a server in near real time.

Latency becomes particularly important here, so application architecture and network efficiency need careful attention.

Collaborative Applications

Documents, whiteboards, and project-management tools can use WebSockets to synchronize changes between users.

When one person modifies an object, other connected users can receive the update almost immediately.

WebSockets vs HTTP

WebSockets and HTTP are not competing technologies in every situation. They solve different problems.

Feature	HTTP	WebSockets
Communication	Request/response	Two-way
Persistent connection	Usually no	Yes
Server can push data	Limited	Yes
Real-time applications	Less suitable	Excellent
Typical usage	Websites and APIs	Chat, live updates, games

A modern application can use both.

For example, HTTP might handle login, user profiles, and normal API requests, while WebSockets handle live messages and notifications.

Important Security Considerations

Real-time communication should not be treated as automatically secure.

For production applications, consider using:

• wss:// instead of unencrypted ws://
• Authentication
• Authorization
• Input validation
• Rate limiting
• Connection limits
• Message-size limits
• Proper error handling
• Origin validation

Never assume that a connected WebSocket client is trustworthy.

If users can send arbitrary content to other users, validate and sanitize that data appropriately.

Scaling a WebSocket Application

The simple examples above work well for learning, but scaling introduces new challenges.

Imagine running three Python servers.

A user connected to Server A sends a message. Another user connected to Server C needs to receive it.

The message cannot simply remain inside Server A's memory.

This is where technologies such as Redis or dedicated messaging systems can become useful. Servers can share events through a central message broker or other distributed infrastructure.

For large applications, you may also need:

• Load balancing
• Connection management
• Horizontal scaling
• Message queues
• Persistent storage
• Monitoring
• Automatic reconnection

The architecture becomes more complex as the number of concurrent connections grows.

Final Thoughts

Python and WebSockets provide an accessible way to begin building real-time applications.

The fundamental idea is simple: establish a persistent connection and allow the client and server to exchange messages whenever necessary.

With FastAPI, creating a basic WebSocket endpoint requires surprisingly little code. From there, you can build chat rooms, live dashboards, notification systems, collaborative applications, and other interactive services.

The real challenge comes when moving from a small demonstration to production. Authentication, security, reconnection, scaling, and reliable message delivery all become important.

Still, WebSockets remain one of the most useful technologies to learn if you want to build modern applications where information moves instantly instead of waiting for the next page refresh.