Oracle has just released the second update to Java 9, bringing it to version 9.0.4. Versions 9.0.2 and 9.0.3 were not released publicly. This is also the final planned release for Java 9, as Java 10 is due to be released in March.
This version includes a number of improvements to security, in the validation of RSA public keys, and other general bug fixes. There are also 21 specific security fixes, of which 18 address vulnerabilities which can be exploited remotely without authentication.
This appears to be an urgent update for anyone using Java 9. It is available from here.