Two years after security patches were published to address the issue hundreds of U.S. K-12 schools still haven’t fixed vulnerabilities in their servers at the root of WannaCry ransomware and its variants.