If a PHP vulnerability allows remote code execution, could it be used to automatically patch the vulnerable servers before attackers exploit it?

In theory, could a proof of concept detect vulnerable installations, apply the appropriate security fix, and verify that the patch was successful?

What technical or practical obstacles would prevent this from working safely at scale?