Same here, username lr. The "/bin/sh: Permission denied" has been happening since yesterday evening around 7:30p; the lack of cron jobs running on the shell server started in the middle of the afternoon (they still don't).
Well, got radical and instrumented "umount" to get pstree's of the system when it is run.
I keep looking at the paths sent from the chroot stopper script => to umount, for cron jobs, when the script should be in a chroot using pam_chroot. If those umounts were to somehow get out of the chroot jail, they would wreck all kinds of havoc. (Which is kind of what I'm seeing.)
I've no-opped _that_ script, too, and we'll see if the system behaves itself.
No idea why this thing would run for weeks without a problem, then suddenly get all wonky on us. But we'll fix it.