As commented in MDL-71916 which introduced an extra request into the curl_security_helper:

We experienced a regression at learn.moodle.org which is likely to affect any other site that has some kind of integration with PayPal based on their IPN protocol - https://developer.paypal.com/docs/api-basics/notifications/ipn/

The issue we were experiencing was that once users paid for their certificates at learn.moodle.org and were redirected back to Moodle, the certificate was not still issued.

We debugged that Moodle hanged when trying to connect to PayPal's IPN endpoint https://ipnpb.paypal.com to verify the payment. To reproduce and test, the following script can be used:

<?php

define('CLI_SCRIPT', 1);

require(__DIR__ . '/config.php');

require_once($CFG->libdir . '/filelib.php');

$c = new curl();

$request = 'cmd=_notify-validate';

$options = [

    'returntransfer' => true,

];

$result = $c->post('https://ipnpb.paypal.com/cgi-bin/webscr', $request, $options);

echo $result;

It should display "INVALID".

However, on our AWS servers it simply hangs until it timeouts after 5 minutes.

On my own notebook the test script works OK so I suspect this is some kind of PayPal's protection against DoS from AWS servers or something like that.