Back on July 1st, CyanogenMod changed the security protection level of Android to display July, but there weren't actually any patches merged.
While looking through the comments, it seems that the patches had yet to be tested, even though the strings that indicate it was up to date, was changed.