and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
attack low confidence

TTP Claims 14 Coordinated Attacks Across Khyber Pakhtunkhwa, Alleges 6 Special Forces Killed in Kurram Ambush

| Afghanistan War

Tehreek-e-Taliban Pakistan (TTP), designated by Islamabad as 'Fitna al-Khawarij,' claimed via its Umar Media propaganda arm to have carried out 14 coordinated attacks across Khyber Pakhtunkhwa on September 12, 2026. The group's most specific claim: an ambush on Special Operations Group (SOG) personnel in the Dombki area of Kurram district, allegedly killing 6 and wounding 10 as survivors withdrew, abandoning a vehicle and weapons. TTP additionally claimed counter-attacks near Mir Ali (North Waziristan), a siege of Frontier Corps posts in Dand Qila and Santoi (South Waziristan), a drone strike on a military camp plus a six-vehicle army convoy ambush on Muddi road near Kalachi (Dera Ismail Khan), an operation in Tank district, a guerrilla raid in Bajaur, a drone attack injuring two soldiers in Peshawar, and a sniper killing near Orakzai. TTP spokesman Muhammad Khorasani said the attacks caused 'significant loss of life and property to the enemy' and acknowledged one TTP fighter killed (Ghufran, alias Muntazar Taqbala). As of publication, Pakistan's ISPR had issued no statement confirming, denying, or addressing any of the 14 claimed incidents, and no independent Pakistani or international outlet had corroborated casualty figures for any of them.

Media

File photo of a TTP training squad, used to illustrate the group's claim of 14 coordinated attacks across Khyber Pakhtunkhwa on September 12, 2026.
File photo of a TTP training squad, used to illustrate the group's claim of 14 coordinated attacks across Khyber Pakhtunkhwa on September 12, 2026. — News Vibes of India

Sources

View full Afghanistan War dashboard