Thousands of PHP sites remain vulnerable because updating is technically challenging. Build a command-line tool that scans for known vulnerabilities and applies safe patches with one command.
Web agencies managing multiple client sites would pay for this time-saver. Start by supporting the most common CMS vulnerabilities.
The risk is breaking sites with custom PHP modifications.