and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
attack low confidence

TTP-Linked Militants Attack Pakistani Security Forces — Continued Operational Tempo on Day 80

| Afghanistan War

May 16, 2026 (Day 80 of Operation Ghazab lil-Haq): India News Network reported militants attacked Pakistani security forces on May 16 with casualties, extending the TTP's sustained operational tempo into its sixth consecutive day of mass-casualty or significant attacks on KPK security forces. This report follows the pattern established by five prior TTP attacks in the preceding six days: Bannu (May 9), Fateh Khel VBIED (May 10), KPK (May 11), Lakki Marwat (May 12), and Meena Scouts Camp-Bajaur VBIED (May 14). The specific location, unit targeted, and casualty figures from the May 16 incident have not been confirmed by Pakistani ISPR or additional Tier-2 sources as of the time of this update. CONFIDENCE CAVEAT: This event is classified as LOW CONFIDENCE / UNVERIFIED pending ISPR confirmation or corroboration from a second independent source. It is included based on single-source reporting from India News Network. If ISPR issues a press statement or the event is reported by Dawn, Geo News, Express Tribune, Al Jazeera, or Reuters, the confidence rating will be upgraded. Context: The TTP (designated 'Fitna al-Khawarij' by Pakistan's military) has been conducting a sustained campaign against KPK border-district security forces throughout May 2026. The attacks are claimed to be staged from North Waziristan, Bajaur, and Kunar-adjacent areas — territory the TTP uses as staging, logistics, and command infrastructure in what Pakistan calls Afghan-harbored sanctuaries. The Taliban IEA has categorically denied all such attributions.

Media

📄 Read article
India News Network reports TTP-linked militants attacked Pakistani security forces on May 16, 2026 — extending the TTP's sustained operational tempo into Day 80 of Operation Ghazab lil-Haq — India News Network

Sources

View full Afghanistan War dashboard