Read update
- Sadly, there's some confusion around Google's security patch messaging. As you can see in the last update to this post, Google suggested that the Oreo update at the end of August already contained the September security patches for certain devices (that's how we read it, at least). As many of you have pointed out in the comments, we're still all stuck on the August 5th security patch, so that's not the case at all. Apologies for contributing to the confusion.
The September 2017 Android security update is here, and the bulletin contains the usual details about vulnerabilities that could be affecting various Android devices. Images and OTAs that include the September patches should protect against any possible issues, but so far they're only available for the Nexus 9 on Android 7.1.1. There are no Android 8.0 Oreo images with September patches for Pixel or Nexus devices live yet, but it shouldn't be too long before they are added.
You can take a look at the security bulletin if you're interested in learning what the September patches are protecting against. Google lists the most dangerous vulnerability as one that affects the media framework and potentially enables a remote attacker access to a device via a special file. As always it's important that these patches are installed on devices as soon as possible, but it's up to OEMs to make sure non-Pixel/Nexus devices are updated in a timely fashion.
When the updates for Google devices are ready, you'll find the factory images here and full OTA images here. We'll update this post to let you know, of course. Most Pixel/Nexus owners don't have to worry about these anyway, as over-the-air updates should be on their way to devices shortly.
Something I missed earlier...
"Pixel, Pixel XL, Pixel C, Nexus Player, Nexus 5X, and Nexus 6P devices will be receiving the September security patches as part of the upgrade to Android Oreo."
That means that those devices already have the September security patches provided they've been updated to Android 8.0 Oreo since it was released last month. We're not waiting for September images for them.
The only device missing from the list that should still be getting security updates is the Nexus 6. Like the Nexus 9, it won't be getting Oreo, which means it should have new factory and OTA images for September. We'll keep an eye out for any change there.
UPDATE: 2017/09/06 2:25pm PDT BY
UPDATE: 2017/09/12 2:41am PDT BY
Sadly, there's some confusion around Google's security patch messaging. As you can see in the last update to this post, Google suggested that the Oreo update at the end of August already contained the September security patches for certain devices (that's how we read it, at least). As many of you have pointed out in the comments, we're still all stuck on the August 5th security patch, so that's not the case at all. Apologies for contributing to the confusion.
In any case, the September OTAs seem to be incoming for some, so stay tuned for more news on that.
Source: Android Source, Google Developers (Images, OTAs)