For those who care more about the underlying OS getting security updates for a long time, 8.04 is still the 'most supported' even if 2 years old. LTS releases have 5 years of updates for servers, so that means 2013. No other Ubuntu server release except the upcoming 10.04 one will be supported that much into the future even if more recent.

Add the fact that turnkey actually uses fresh packages for many appliances and uses only the kernel+base system of Ubuntu LTS, it makes perfect sense.

The new release 2009.10-2 [1] is pre-installed with all security updates that have come out since the last release batch. Security updates will also be installed on first boot to prevent a window of vulnerability from opening between the time a fresh appliance is deployed and until the (daily) cron job that installs the security updates runs.

Note that Ubuntu 8.04 is a Long Term Support (LTS) release which will continue to be supported by Canonical with security updates for another 3 years (until April 2013).

All appliances will be rebuilt on top of Lucid (the new LTS) when it is released at the end of the month.

[1] http://www.turnkeylinux.org/blog/maintenance-release