Which PHP version should I be running?

Run the newest PHP version your application fully supports and that is still receiving security updates — not the oldest version that happens to still work. Every PHP release follows a fixed support window, after which it stops receiving security fixes entirely, and a site left running on an unsupported version is exposed to any vulnerability discovered after that cut-off with no fix ever coming for it.

Two things to check, in this order

1. Is the version still supported? PHP.net publishes the support timeline for every release. A version past its end-of-life date should be moved off regardless of anything else, because "it still works" and "it is still safe" stop meaning the same thing once security fixes end.
2. What does your application actually require? WordPress, Laravel, and most well-maintained plugins and packages declare a minimum PHP version, sometimes also a maximum. Check that before assuming the newest available version is automatically the right choice — a genuinely current application should support a genuinely current PHP version, but it is worth confirming rather than guessing.

Newer is also generally faster

Beyond security support, each major PHP release has generally improved on the raw performance of its predecessor, so an application on an old version is very likely leaving some performance on the table as well as running with known, unpatched vulnerabilities. Neither of those is the primary reason to upgrade — the security point stands on its own — but it is a fair secondary reason to move sooner rather than later once support has genuinely ended for the version you are on.

What if an old plugin or package will not support anything newer?

This is the case that actually needs judgement. If one specific dependency is what is holding a whole site back on an unsupported PHP version, the dependency is usually the thing to replace rather than the reason to stay indefinitely on a version with no security support — an unmaintained plugin is itself a security risk independent of PHP. Look for an actively maintained alternative before accepting a permanently outdated PHP version as the price of keeping it.

Once you know the version you should move to, upgrading PHP safely covers testing the change before it reaches your live site, and checking your current PHP version confirms exactly where you are starting from.