Certain core Concrete CMS classes are extendable via classes found in the application/ directory. This extendability happens automatically, if the class is namespaced properly and found in the proper location. Individual component documentation specifies which Concrete components are extendable in this way, but in general it follows a couple specific rules.
Extending Controllers
If you've ever created your own custom block in the application/ directory, you're somewhat familiar with controller extension. In general, a block type or attribute controllers that's in the core can be extended by creating the same controller in application/.
namespace Application\Block;
class Content extends Concrete\Block\Content\Controller
{
}
This same setup works for attribute controllers and core view controllers.
Extending Core src/ Classes
Certain aspects of the core that live in the concrete/src/ are extendable or replaceable with classes in the application directory. For example, let's say you want to extend or replace the Concrete SecurImage Captcha controller. This controller is located at
src/Captcha/SecurimageController.php
This means it has the namespace Concrete\Core\Captcha\SecurimageController.
To use a different controller for this captcha library, simply create one in
application/src/Concrete/Captcha/SecurimageController.php
And give it the namespace Application\Concrete\Captcha\SecurimageController.
For all items that can be extended in this way, just make sure to add the overriding items to application/src/Concrete, and start the namespace with Application\Concrete.
How do I know which items can be extended in this way?
These should be documented in the Developer Documentation; if you don't see an entry, look in the Concrete source for the method overrideable_core_class(). It's a hint that the item being instantiated will be loaded from application/ first, before trying the core.