It happened midway into a mass.

At around 8.30am yesterday, a bomb ripped through a Roman Catholic cathedral in Jolo, a poverty-racked island of some 700,000, in the mainly Muslim province of Sulu, in the Philippines' restive south.

Hundreds stampeded out through the main door.

But the carnage was not over yet.

Minutes later, as first responders, mostly army troops and police, arrived on the scene, a second blast tore across a parking lot just outside the church compound.

By late afternoon, Chief Superintendent Graciano Mijares, police chief in the region that covers Sulu, had tallied at least 20 dead, and over 100 wounded, including 14 soldiers and two men from the Coast Guard.

The initial explosion mowed down a large section of wooden pews inside the cathedral's main hall. The second bomb, said to have been rigged onto a motorcycle, exploded in a more crowded area, hurling human remains and debris across a town square fronting the church, named the Cathedral of Our Lady of Mount Carmel.

Images on social media and photos filed by wire agencies showed a grisly scene of bodies covered with blankets lying on a busy street.

President Rodrigo Duterte's spokesman Salvador Panelo said in a text message: "The (military) will rise to the challenge and crush these godless criminals... We will pursue to the ends of the earth the ruthless perpetrators behind this dastardly crime until every killer is brought to justice and put behind bars."

No one immediately claimed responsibility for the attack.

"We don't have any lead yet. We're looking at different threat groups in the area. We can't say yet if this has anything to do with the recent plebiscite," said director-general Oscar Albayalde, the police chief.

But Mr Mujiv Hataman, governor of the Autonomous Region in Muslim Mindanao (ARMM) that covers Sulu, told the online news site Rappler he was "99 per cent certain" the Abu Sayyaf, a gang of self-styled Islamist militants founded in the 1990s, was behind the attack.

Abu Sayyaf has attacked the cathedral at least twice before, with grenades, in 2010 and 2013.

A report in the Inquirer, citing a university professor in Jolo who has dealt with militants as a peace advocate, said the military uncovered a plot by the Abu Sayyaf to bomb Jolo as early as five months ago.

It prompted security forces to close the street in front of the cathedral, said Professor Octavio Dinampo. After 20 days, though, the street was reopened.

The Abu Sayyaf has long used Sulu as a base, carrying out kidnappings and bombings.

It has pledged allegiance to the Islamic State in Iraq and Syria (ISIS).

Though the group officially has a separatist Islamist agenda, it has capitalised on decades of instability in Mindanao to generate tens of millions of dollars from piracy and ransom payments. It is still holding at least five hostages - a Dutch national, two Malaysians, an Indonesian and a Filipino - in their jungle bases mostly near Sulu's Patikul town, not far from Jolo.

The latest attack came nearly a week after more than 1.5 million Muslims, a minority in the predominantly Catholic nation, overwhelmingly approved a more powerful autonomous region in the Philippines' south.

They had voted for the new, self-administered region called the "Bangsamoro", or nation of Moros, in the war-torn island of Mindanao, in hopes of ending nearly five decades of a separatist rebellion that has left over 150,000 people dead.

Voters in Sulu, however, rejected it. Still, the province will be included in the new Bangsamoro region, as it is part of the ARMM, which as a bloc voted overwhelmingly in favour of the Bangsamoro law.

That has raised fears of reprisals by militant groups. Those fears seem to have come true.