and extracts the following text as a script body — the dev server then fails its dependency scan with `Expected ";" but found "non"` from the words "non-allowlisted hosts", which breaks e2e. So, what this buys, so nobody reads more or less into it: blocks external `script src=` from non-allowlisted hosts blocks injected inline scripts — each one is pinned by hash blocks fetch/XHR/WebSocket exfiltration (connect-src allowlist) blocks form-action, base-uri, object-src vectors does not stop image-based exfiltration — img-src must allow https: because event media comes from arbitrary publishers' og:image The cost of hashing is that an inline script edited after the hashes are computed is silently refused by the browser. That is why the violation reporter below exists: report-uri/report-to are ignored in a meta element and Pages serves no CSP header, so violations are caught in-page and sent to PostHog instead (src/lib/csp-report.ts, #241). frame-ancestors is deliberately NOT in this string: it is ignored in a meta element and browsers log a warning about it on every page load. It lives in public/_headers instead, ready for a CDN in front of Pages. X-Frame-Options (set there too) is the clickjacking control that actually applies today. */ }
military medium confidence

Pakistani Forces Kill Several Afghan Taliban Fighters After Attempted Border Incursion in Gulistan, Balochistan

| Afghanistan War

Pakistani security forces killed several Afghan Taliban fighters — reported by some outlets as 13 — in an overnight clash in the Gulistan sector of Qila Abdullah district, Balochistan, after Afghan Taliban forces attempted to enter Pakistani territory and attacked Pakistani border posts late on September 24 into the early hours of September 25, 2026. Pakistan's state-run Associated Press of Pakistan, citing security sources, said Afghan Taliban forces 'attempted to enter the Pakistani territory in Balochistan's Gulistan sector and carry out an act of aggression,' and that Pakistani troops responded in a retaliatory action along the border. An intermittent exchange of fire between security forces and Afghan Taliban was ongoing after midnight, with fighting continuing into Friday morning. The clash follows Pakistan's September 24 airstrikes on 10 sites in Kandahar, Paktia and Khost — which Afghan officials said killed four civilians — and Taliban spokesman Zabihullah Mujahid's warning that Kabul would deliver an 'appropriate response' to those strikes. Neither Pakistan's military nor Afghanistan's Taliban government issued an official, on-record casualty confirmation at time of writing.

A soldier keeps watch at the Pakistan-Afghanistan border in Chaman, Balochistan, near the Gulistan sector where forces clashed with Afghan Taliban fighters on September 25, 2026.
A soldier keeps watch at the Pakistan-Afghanistan border in Chaman, Balochistan, near the Gulistan sector where forces clashed with Afghan Taliban fighters on September 25, 2026. — Dawn / AFP