The last security updates for OpenJDK were only released for OpenJDK 10. OpenJDK 9 is now unsupported upstream. At some point in the near future we should switch to OpenJDK 10 as the default JDK (which is supported at least until early 2019). At some point the the not so distant future, i.e. before any Debian freeze, we should switch to OpenJDK 11 as the default JDK. This is the OpenJDK which supposedly will see some long term support. LTS by Oracle/OpenJDK speaking means twice the time of a short term release (i.e. 12 months); LTS by Oracle/OpenJDK writing and/or wishful thinking means 36 months. Please watch [1] and have your own interpretation. However it looks like that OpenJDK 11 will see some extended long term support by other contributors. The fallback for Debian, if OpenJDK cannot be made the default, would be to default the next Debian release to OpenJDK 8, which is still supported by OpenJDK (the jdk8u project handed over to project owners outside of Oracle).
Side note: The upcoming Ubuntu 18.04 LTS release is shipping with OpenJDK 10 as the default, hopefully having OpenJDK 9 removed from the archive for the release. The goal is to update the 18.04 LTS to OpenJDK 11 once it is released. Patches for 10 compatibility are submitted to Debian, or should be submitted shortly (with Tiago doing most of the work). Matthias [1] https://fosdem.org/2018/schedule/event/state_openjdk/