and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
attack medium confidence

BLA Claims 13 Killed in Convoy Ambush, Bridge Blast Near Mastung's Khadkocha; Pakistan Confirms 2 Dead

| Afghanistan War

On the night of August 22, 2026, Baloch Liberation Army (BLA) militants detonated an IED that destroyed a Pakistani military armoured vehicle in the Khadkocha area of Mastung district, Balochistan, then ambushed a second armoured vehicle and its accompanying convoy. BLA spokesperson Jeeyand Baloch said the group's 'Special Tactical Operations Squad' carried out the attack and claimed 13 security personnel killed and 10+ injured, with two armoured vehicles destroyed. Pakistani authorities did not match that toll: regional hospital sources said 2 bodies and 8 wounded personnel were brought to Nawab Ghaus Bakhsh Raisani Memorial Hospital in Mastung, with additional wounded airlifted to Combined Military Hospital (CMH) Quetta; a Dawn-network report described it as a single roadside IED in the nearby Goru area that killed 2 and injured 8, with no group claiming responsibility in that account. Separately the same night, unidentified attackers destroyed a culvert/bridge on the N-25 Quetta-Karachi highway near Injiri Cross-Khadkocha, disrupting traffic; no casualties were reported in that blast. The Balochistan Home Department imposed an indefinite curfew in Khadkocha and surrounding areas from 7:00 a.m. on August 23.

Media

A highway bridge on the N-25 near Khadkocha, Mastung, destroyed in an overnight explosion.
A highway bridge on the N-25 near Khadkocha, Mastung, destroyed in an overnight explosion. — The Express Tribune

Sources

View full Afghanistan War dashboard