AOSP Kitkat security patches

Where does Google publish the Kitkat security patches? According to:
http://ift.tt/28O2HCe
fixes do exist for 4.4.4, but I can't find any updated AOSP branches (beyond 4.4.4_r2).

from xda-developers http://ift.tt/28NYgTO
via IFTTT