by Ken Task.
Don't run what you run ... a couple of thoughts.
PHP does have to have exec() function me thinks.
So a phpinfo.php script at code root would show that.
"disable_functions" ??? Check your main php.ini
Also, what of moodledata/sessions/ ? Was site using DB for session and it flipped on ya and wants now to use files ... thus sessions directory would have to be created and session files created therein.
Also check out moodledata/temp/. could been a cron job/task running at the time of your mishap.
Couple of thoughts - total guess, really! :|
'SoS', Ken