A coordinated attack struck a mosque inside the Old Police Lines in Kohat, Khyber Pakhtunkhwa, on Friday, September 18, 2026, during prayers. An explosives-laden vehicle was driven into the police compound, followed by an assault by armed men who entered the complex and exchanged fire with police and counterterrorism personnel. By September 19, the reported death toll had risen to at least 31, including 16 police personnel, while more than 100 people were reported injured.
The broad sequence of events is established, but important details remain unsettled. Early reports gave substantially lower casualty figures, and accounts differed over whether all attackers had been killed and how many militants were involved. Responsibility is also more complicated than some early headlines suggested: a group identified as Ittehadul Mujahideen, led by Hafiz Gul Bahadur, claimed the attack, while the TTP was also discussed as a likely suspect and has denied responsibility. Pakistani authorities have described the attackers as militants associated with the banned TTP, but the organizational relationship between the claimed perpetrators and the TTP requires careful distinction.
What happened in Kohat
The attack began at a police compound in Kohat, a city in Khyber Pakhtunkhwa near Pakistan’s border region with Afghanistan.
The target was not simply a mosque. The mosque was located within a police facility where officers, their families and other civilians were attending Friday prayers. The compound also contained important security offices, including the police Special Branch and Counter Terrorism Department facilities.
According to Khyber Pakhtunkhwa police, an attacker drove an explosives-laden vehicle into the compound. The resulting blast damaged the mosque and brought down part of the surrounding structure. Armed attackers then entered the complex, triggering a prolonged gun battle with police and security forces.
The assault therefore appears to have had two interconnected phases:
- A vehicle-borne suicide bombing at the police compound.
- A subsequent armed assault and standoff inside the facility.
Security forces ultimately conducted an overnight clearance operation. Dawn reported on September 19 that eight attackers had been killed, including the suicide bomber, while the Associated Press reported that the operation lasted about 20 hours.
The casualty count changed rapidly
One of the clearest lessons from the first 24 hours is why early casualty figures should be treated cautiously.
| Report or stage | Reported casualties | What it represented |
|---|---|---|
| Initial reports, September 18 | At least 7 dead, more than 30 injured | Early rescue figures while the scene was still active |
| Reuters report, September 18 | At least 16 dead, 57 wounded | Later official figures during the continuing operation |
| AP report, September 19 | 21 dead, 103 wounded | Updated figures cited after the prolonged confrontation |
| AFP/Reuters report, September 19 | 31 dead, more than 100 injured | Later police figure, including 16 police personnel |
The differences do not necessarily indicate contradictory events. Rescue operations, hospital transfers and the discovery of additional bodies can cause casualty figures to rise substantially during the first hours after a major attack.
For that reason, 31 deaths is the latest figure reported as of September 19, but it should be understood as a developing casualty count rather than necessarily the final toll. Reuters attributed the figure to AFP, which cited a police official.
Who was targeted?
The location provides an important clue about the likely objective, although motive cannot be established solely from the target.
The compound housed police and counterterrorism personnel, and many of the victims were police officers or people connected to them. Dawn reported that 15 police personnel were among the 21 deaths in its earlier account, while the later AFP figure cited by Reuters put the number of police fatalities at 16.
The presence of the Special Branch and Counter Terrorism Department is also significant. These units are directly involved in intelligence gathering and counter-militancy operations in the province.
The attack consequently appears to have combined a mass-casualty attack at a place of worship with an assault on a security installation.
That distinction matters. Describing the incident only as a “mosque bombing” obscures the fact that the mosque was situated inside a police complex and that armed attackers subsequently attempted to penetrate and hold parts of the facility.
What happened after the explosion?
The blast did not end the attack.
Police reported that armed attackers entered the compound after the initial explosion. Security forces engaged them in a prolonged firefight, with militants taking positions inside buildings.
The Associated Press reported that the complex housed the police Special Branch, Counter Terrorism Department offices and accommodation for counterterrorism officers. The confrontation continued into Saturday morning before security forces declared the operation over.
Dawn reported that the attackers entered the Special Branch building and that Khyber Pakhtunkhwa’s Counter Terrorism Department led the clearance operation. It also reported that the CTD’s additional inspector general was injured by a grenade during the operation.
By Saturday, police said the attackers had been eliminated and the compound cleared. The exact accounting of individual attackers varied in early reports, however, which is one reason the sequence should be separated from the still-evolving details.
Who claimed responsibility?
This is one of the most important unresolved aspects of the attack.
Dawn reported that Ittehadul Mujahideen, an organization led by Hafiz Gul Bahadur, claimed responsibility. The report also noted that Pakistani authorities use the term “Fitna al-Khawarij” for militants belonging to the banned Tehreek-i-Taliban Pakistan (TTP).
Other early international reports initially said that no group had claimed responsibility. The Washington Post’s September 19 account, for example, said no organization had immediately claimed the assault and noted that suspicion would likely fall on the TTP because of its intensified attacks against Pakistani security forces.
The situation was further complicated by reporting that the TTP itself denied responsibility. The National reported that the Pakistani Taliban rejected involvement in the attack.
These claims should not be treated as interchangeable.
A group’s claim of responsibility establishes that the organization says it carried out an attack; it does not by itself independently establish operational responsibility. Likewise, a denial does not conclusively disprove involvement.
The organizational relationship among Hafiz Gul Bahadur’s network, Ittehadul Mujahideen and the broader TTP militant ecosystem is therefore an important subject for investigators rather than something that can safely be collapsed into a single label.
Why Kohat matters
Kohat is in Khyber Pakhtunkhwa, one of the principal centres of Pakistan’s current militant violence.
The province has experienced sustained attacks involving the TTP and other armed groups, particularly in districts near the Afghanistan frontier and across southern KP. Police and other security forces have increasingly been targets.
The Kohat attack fits that broader pattern while possessing several characteristics that make it particularly significant: the use of a vehicle-borne explosive, an assault on a police facility, an attack occurring during Friday prayers and a subsequent prolonged armed confrontation.
It also echoes an earlier pattern of attacks against mosques located inside police compounds.
In January 2023, a suicide bomber killed more than 100 people at a mosque inside a heavily fortified police compound in Peshawar, the capital of Khyber Pakhtunkhwa. Most of the victims were police officers.
The comparison does not establish that the Kohat attackers followed the same operational plan or belonged to the same organization. It does, however, demonstrate why mosques inside security facilities can present a particularly difficult security challenge: they bring large numbers of police personnel and civilians together at predictable prayer times within otherwise protected compounds.
What remains unclear
Several questions cannot yet be answered confidently from the available evidence.
The final death toll
The reported toll increased from seven to 16, then 21 and subsequently 31 within roughly a day. Further updates may be possible as hospitals and authorities reconcile their figures.
The precise number of attackers
Early reports described seven attackers. Later accounts referred to eight attacker bodies, while also distinguishing between suicide bombers and gunmen. The exact number and roles of everyone involved therefore require further confirmation.
Who planned and directed the operation
A claim by Ittehadul Mujahideen provides one piece of evidence, but independent confirmation of command, planning and logistics is still required.
The TTP’s reported denial also means that simply describing the attack as a TTP operation would go beyond what the currently available evidence firmly establishes.
Whether the attackers had inside assistance
Because the assault targeted a security compound and attackers subsequently reached buildings within it, investigators will likely examine how the attackers obtained information about the facility, its routines and security arrangements.
At present, publicly available reporting does not establish whether there was an insider, an intelligence breach, surveillance beforehand or another explanation.
The precise motive
The choice of a police compound strongly suggests that security personnel and counterterrorism institutions were central targets. But the decision to strike while people were attending Friday prayers also created a substantial civilian dimension.
Determining whether the mosque itself was specifically selected as part of the attack plan, rather than being targeted because it was inside the police compound, requires evidence that has not yet been publicly established.
The Afghanistan connection remains a separate question
Pakistan’s wider militant crisis has an important cross-border dimension.
Pakistani authorities have repeatedly accused militants, particularly the TTP, of maintaining bases or networks in Afghanistan. Afghanistan’s Taliban government has rejected those allegations. The TTP is separate from Afghanistan’s Taliban but is regarded as an allied organization.
That broader dispute should not automatically be presented as proof of an Afghan role in the Kohat attack.
There is currently a difference between the established location of the attack, the identity claimed by the perpetrators, allegations concerning militant sanctuaries and evidence establishing who planned this particular operation. Those are four separate questions.
Keeping them separate is essential if the attack is to be understood accurately.
The security significance of the attack
The Kohat assault illustrates a difficult feature of Pakistan’s current security environment: militants can combine conventional terrorist tactics with attacks on hardened security installations.
The initial vehicle bombing created mass casualties and breached the perimeter. The follow-on gun attack then forced police and counterterrorism units into a prolonged close-quarters operation.
That combination places pressure on both layers of security. The first phase tests perimeter protection and intelligence; the second tests the ability of security forces to isolate, contain and clear an armed group after an initial breach.
The attack also demonstrates why casualty figures alone cannot describe the operational significance of an incident. A relatively short bombing can have one set of consequences; a 20-hour armed standoff inside a police complex creates an entirely different security problem.
What investigators will need to establish next
The most important developments will be evidence rather than additional speculation.
Investigators will need to establish the identities of the attackers, determine how the explosives-laden vehicle reached the compound, reconstruct the movement of the gunmen, and establish whether the claimed organization was actually responsible.
They will also need to reconcile the casualty figures and determine whether everyone reported missing or injured has been accounted for.
Finally, the investigation will need to distinguish between operational responsibility and broader militant affiliation. That distinction matters in an environment where several armed organizations operate in the same region and where groups may share personnel, ideology, alliances or logistical networks without necessarily sharing a single command structure.
As of September 19, 2026, the clearest picture is therefore this: Kohat suffered a coordinated vehicle-bomb and gun attack on a police compound during Friday prayers; dozens were killed or wounded, with the latest reported death toll at 31; security forces subsequently conducted an overnight clearance operation; and a Hafiz Gul Bahadur-led organization has claimed responsibility while the TTP has denied involvement. The remaining questions—particularly the final casualty count, exact number of attackers, command structure, planning and any external support—require further evidence before they can be stated as established fact.