The rescue attempts had taken place over two days, Philippine regional military spokesman Lieutenant Colonel Gerry Besana said on Saturday.
He added that this happened while Philippine marines were attempting to rescue them from Simusa Island in Southern Sulu province.
Abu Sayyaf terrorism
Abu Sayyaf is recognized by the Philippines as a terrorist organization, aligned with the Islamic State, and has carried out a number of bombings, kidnappings, and beheadings in the past.
Heri Ardiansyah, the Indonesian who swam to safety, was rescued by marines on board a gunboat, while the body of his fellow Indonesian Hariadin, who only uses one name, was recovered from the water.
The military said Jari Bin Abdullah, the Malaysian, was shot by militants as he tried to escape on Thursday. The marines tried to rescue him and had a gun battle with Abu Sayyaf militants.
"The act of shooting the kidnap victim is indicative of the Abu Sayyaf's hopelessness and desperateness as the militants are now surrounded by our pursuing troops," said military commander, Brig. Gen. Divino Rey Pabayo Jr.
Bin Abdullah was airlifted to a Zamboanga city hospital, where he remains in critical condition, said the Philippines military.
The military had surrounded Simusa Island in order to capture the remaining Aby Sayyaf gunmen. The military said they seized four assault rifles, a grenade launcher, and ammunition.
All three hostages had been kidnapped on the island of Borneo in Malaysia last December and were taken to Sulu, a poor, Muslim-majority province where a few hundred Abu Sayyaf militants remain.
The army exchanged fire with about 80 Abu Sayyaf gunmen in Patikul town, where three soldiers and four militants died. The military said several were wounded on both sides.
Abu Sayyaf said it had killed three and wounded 13 soldiers, but denied there were casualties on their side, saying "the mujahideen returned safely to base."
Those on Simusa Island are part of the group headed by Commander Hajan Sawadjaan.
On Simusa Island, two Filipinos remain in captivity, along with Elwold Horn, a Dutch bird watcher who was kidnapped in 2012.