Replace it in steps when the system can be split: new code handles one area at a time while the old system keeps the rest. Risk stays small and value arrives early, but you run two systems for a while and something has to keep their data consistent.
Rebuild alongside it when the old code can't be separated, as is common with old PHP that has no framework. Both versions run in parallel and you compare their results. This takes more patience, and it is the only way to make a rewrite verifiable.
Leave it alone when the system works, is secure enough and isn't holding anything back. That is an unusual recommendation for a supplier to make, but not every old system is a problem. Sometimes putting it behind a modern API is enough.