and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
military high confidence

Pakistan Resumes Cross-Border Airstrikes After 3-Month Pause, Hits Kunar and Paktika; Claims 28 Killed, Taliban Says 3 Civilians Dead

| Afghanistan War

Pakistani jet fighters struck three targets in eastern Afghanistan around 3:00am on September 21, 2026, in Nurgal district, Kunar province, and Barmal district, Paktika province — the first confirmed Pakistani cross-border strikes since the June 28-29 Chamkani-Gyan-Marawara package, ending a nearly three-month pause. Pakistan's Ministry of Information said the 'calibrated' strikes destroyed three targets, including a suicide-bomber training center, killing 28 'terrorists and suicide bombers' linked to the Hafiz Gul Bahadur faction and Fitna al-Khawarij (TTP), in retaliation for the September 18-19 Kohat Police Lines mosque bombing and the September 20 Hangu firefight that killed six security personnel. Afghan officials gave a starkly different account: one strike hit a residential home in Nurgal, killing three members of the same family (including one woman) and wounding four others; two further strikes on Barmal, Paktika caused property damage with no reported casualties there. Taliban chief spokesman Zabihullah Mujahid condemned the strikes as 'aggression and a continuation of crimes' committed 'to divert attention from their country's security failures' and vowed an 'appropriate response.' Pakistan's Ministry of Information dismissed the Taliban's warnings as a 'pretence of dialogue.'

Media

A Pakistan Air Force JF-17 Thunder, the type of aircraft used in the September 21, 2026 strikes on Nurgal (Kunar) and Barmal (Paktika) districts.
A Pakistan Air Force JF-17 Thunder, the type of aircraft used in the September 21, 2026 strikes on Nurgal (Kunar) and Barmal (Paktika) districts. — Dawn

Sources

View full Afghanistan War dashboard