It's definitely homebrew, Apple hasn't patched their binaries. Don't let this give you to a false sense of security. Many scripts could still be hardcoded to use your vulnerable /bin/bash binary, and many more won't load the PATH variable from your ~/.bash_profile. The only way to fix the problem is to patch /bin/bash and /bin/sh, updating homebrew is not nearly enough.

Homebrew has patched Bash for all 3 recently announced vulnerabilities, yes. The vulnerable bash will still be lurking on your system though, in /bin/bash and /bin/sh.

My 10.9.5 box fails the tests.

What does

  /bin/sh --version

give you?